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organizational forms for an increasingly complex environment. It is 

this possibility that warrants an effort to move HROs more centrally 
into the mainstream of organizational theory and remedy the puzzling state of 
affairs identified by Scott in the epigraph. Stated summarily, HROs warrant 
closer attention because they embody processes of mindfulness that suppress 
tendencies toward inertia. The fact that HROs are seldom portrayed this way or 
used more widely as templates for organizational design is due partly to their 
seeming exoticness and partly to uncertainty about how they might generalize 
to organizations that operate under less trying conditions. We will argue that 
HROs are important because they provide a window on a distinctive set of pro- 
cesses that foster effectiveness under trying conditions. 

The processes found in the best HROs provide the cognitive infrastructure that 
enables simultaneous adaptive learning and reliable performance. A focus on these 
processes represents a theoretical enrichment of previous discussions on the origin 
and context of organizational accidents (e.g., Perrow, 1984) which have been 
framed in a largely macro-level, technology-driven structural perspective. The en- 
richment arises from the fact that, by explicating a set of cognitive processes that 
continuously reaccomplish reliability, we supply a mechanism by which reliable 
structures are enacted. This mechanism is often underdeveloped in non-HROs 
where people tend to focus on success rather than failure and efficiency rather 
than reliability. We suspect that failures in process improvement programs built 
around reliability (e.g., Total Quality Management) often occur because the cog- 
nitive infrastructure is underdeveloped. 

We will construct the argument that processes as well as consequences dis- 
tinguish HROs in the following manner. First, we sample the existing literature 
on HROs to establish the eclectic nature of the data base, the limited range of 
concepts imposed so far on these data, and the reasons why this literature has not 
had more impact on mainstream organizational theory. Given this background, 
we then take a closer look at bridges between HROs and traditional organizational 
theory afforded by the concepts of reliability and mindfulness. We then move to 
the heart of the analysis and argue that organizing for high reliability in the more 
effective HROs, is characterized by a preoccupation with failure, reluctance to 
simplify interpretations, sensitivity to operations, commitment to resilience, and 
underspecified structuring. These processes reduce the inertial blind spots that 
allow failures to cumulate and produce catastrophic outcomes. The analysis con- 
cludes with a discussion of the implications for organization theory and practice. 


He: reliability organizations (HROs) are harbingers of adaptive 
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Conceptual Background 
The Concept of High Reliability 


When people refer to HROs they usually have in mind organizations such as 
nuclear power-generation plants (e.g., Marcus, 1995; Bourrier, 1996), naval aircraft 
carriers (e.g., Rochlin, LaPorte, & Roberts, 1987), air traffic control systems 
(e.g., LaPorte, 1988), and space shuttles (Vaughan, 1996), to list some examples. 
When we describe processes used in effective HROs, we have in mind cognitive 
processes found in better nuclear power plants, nuclear aircraft carriers, and the 
air traffic control system. These three settings constitute our “default” referent 
when specific studies are not available to illustrate the precise contrast we are 
making between effective and ineffective practice. Diverse as HROs may seem, 
we lump them together because they all operate in an unforgiving social and 
political environment, an environment rich with the potential for error, where the 
scale of consequences precludes learning through experimentation, and where to 
avoid failures in the face of shifting sources of vulnerability, complex processes 
are used to manage complex technology (Rochlin, 1993). There is considerable 
variation among high hazard organizations in these qualities as is evident in the 
fact that many of them are known by their failures to remain reliable (e.g., Bhopal, 
Chernobyl, Exxon Valdez). However, we intend to focus on commonalities in the 
better ones rather than variation to highlight a distinctive perspective on reliabil- 
ity that these organizations share in theory, if not always in practice. 

The literature on HROs that behave “under very trying conditions” (LaPorte 
and Rochlin, 1994, p. 221), thus the data base available to us for analysis, consists 
of an eclectic mix of case studies involving effective action (e.g., Diablo Canyon 
in Schulman, 1993b), limited failure (e.g., Hinsdale telephone switching center 
fire in Pauchant, Thierry, Mitroff, Weldon, & Ventolo, 1991), near catastrophes 
(e.g., Three Mile Island cited by LaPorte, 1982), catastrophic failures (e.g., 
‘Tenerife disaster in Weick, 1990b), and successes that should have been failures 
(e.g., nuclear weapons management in Sagan, 1993). Existing analyses of these 
cases tend to emphasize structure and technology rather than process; activities 
involving anticipation and avoidance rather than activities involving resilience 
and containment; more focus on interorganizational macro levels of analysis 
than on micro group levels of analysis; more concern with fatalities than with 
lasting damage in other domains such as reputation, legitimacy, and survival 
of the social entity; and more implied comparisons with traditional trial and 
error organizations than with other high reliability organizations where the first 
error is the last trial. 

At least two streams of work have addressed organizing around high hazard 
technologies within organizations — Normal Accidents Theory (NAT) and High 
Reliability Theory (HRT). NAT is based on Perrow’s (1984) attempt to translate 
his understanding of the disaster at Three Mile Island (TMI) into a more general 
formulation. What stood out about TMI was that its technology was tightly 
coupled due to time-dependent processes, invariant sequences, and limited slack. 
The events that spread through this technology were invisible concatenations 
that were impossible to anticipate and that cascaded in an interactively complex 
manner. Perrow hypothesized that any system in which elements were tightly 
coupled and interactively complex would have accidents in the normal course of 
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operations precisely because of this combination of lack of control and inability to 
comprehend what was happening. These systems include aircraft, chemical plants, 
and nuclear power plants. He argued that a change in either dimension — from 
tight to loose coupling, or from an interactively complex to linear transformation 
system — would reduce the incidence of catastrophic error. 

HRT also considers high-risk technologies but focuses on a subset of high-risk 
organizations, high reliability organizations, that take a variety of extraordinary 
steps in pursuit of error-free performance (e.g., Weick, 1987; Roberts, 1990; 
Rochlin, 1993; Schulman, 1993a, 1993b; LaPorte, 1994). Some of the necessary but 
not sufficient conditions that HRT emphasizes are a strategic prioritization of 
safety, careful attention to design and procedures, a limited degree of trial-and-error 
learning, redundancy, decentralized decision-making, continuous training often 
through simulation, and strong cultures that create a broad vigilance for and respon- 
siveness to potential accidents (LaPorte & Consolini, 1991; LaPorte, 1994). 

Because HRT is relatively new, some of the basic assumptions included in this 
body of work continue to evolve. Early characterizations of HROs emphasized the 
total elimination of error and the absence of trial-and-error learning (Weick, 1987) 
while later characterizations appear to allow for the inevitability of errors and the 
importance of a limited degree of trial-and-error learning based on those errors 
(LaPorte & Consolini, 1991). Early high reliability theory stressed the closed sys- 
tem nature of high reliability organizations (Weick, 1987; Weick & Roberts, 1993) by 
suggesting that these organizations tend to be more buffered from environmental 
influences and work actively to develop and maintain those buffers (LaPorte 
& Consolini, 1991). Later versions of high reliability theory (Rochlin, 1993; LaPorte & 
Rochlin, 1994) recognize the active influence of exogenous influences like regu- 
lations and public perception. Similarly, earlier versions of high reliability theory 
appear to stress the singular focus of HROs on safety where more recent work 
recognizes how HROs actively pursue multiple objectives (e.g., safety AND ser- 
vice) (Rochlin, 1993; LaPorte & Rochlin, 1994). 

Each stream of work has registered serious concerns about fundamental prem- 
ises contained in the other’s theorizing. Normal accident theorists (principally 
Perrow and Sagan) criticize high reliability theorists’ for neglecting complex en- 
vironmental influences that compromise the alleged single-minded pursuit of 
safe operations. They point to the complex political and social forces that often 
corrupt the capacity to honestly report and learn from shortcomings. Specifically, 
ambiguous cause and effect relationships and politically motivated cover-ups of 
accidents compromise trial and error learning (Sagan, 1994). Moreover, they argue 
that competing interests seldom align behind safety. Rijpma (1997) has argued that 
NAT theorists believe that reliability-enhancing strategies actually increase the like- 
lihood of normal accidents. Thus, redundancy can make the system more complex by 
making it more opaque, centralized decision premises can induce blind spots, con- 
ceptual slack can “shatter” a common perspective and spread confusion, and learn- 
ing may anticipate complexity but fail to stop it from escalating. 

Conversely, high reliability theorists have criticized normal accident theorists 
for their disregard of the conditions under which a tightly coupled interactively 
complex system will not fail. Assertions such as, “no matter how hard we might try, 
the characteristics of complexly interactive and tightly coupled systems will cause 
a major failure, eventually” (Perrow, 1994a, p. 216) raise the question, how long 
does a system need to avoid disaster for that avoidance to count as evidence against 
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the hypothesis of vulnerability to normal accidents. Also, most organizations are 
not frozen into one of the four combinations that are possible in Perrow’s 2 x 2 
of loose/tight coupling and linear/complex interaction. Instead, whole organ- 
izations change character in response to changed demands, some portions of any 
organization fit all four combinations, and all organizations, because of inter- 
connected technologies and interconnected resource demands, are moving to- 
ward an interactively complex tightly coupled state (Weick, 1990a, pp. 29-34). 
Rijpma (1997) also weighs in with the suggestion that interactive complexity 
and tight coupling may actually increase overall reliability. Complexity and tight 
coupling motivate designers to create more redundancy in a system, inspire 
operators to customize centralized decision premises, favor the development of 
multiple theories of system functioning, and encourage learning and discour- 
age complacency. 

If we return to Scott’s question of why HROs are not linked to the main- 
stream, one answer is that there is insufficient coherence to generalize. Perrin 
(1995, p. 157) draws a similar conclusion and cites the Royal Society’s observation 
that the research map on the topic of organizational risk looks “a bit like the 
population map of Australia, with almost everything clustered round the edges 
and hardly anything in the central conceptual areas.” Other plausible answers to 
Scott’s question are that the existing work is more descriptive than theoretical; 
the literature itself is treated more as if it is about accidents than about or- 
ganizations; the meaning of the idea of reliability is treated as obvious; simplistic 
binary distinctions contrast HROs with all other organizations; and there is limited 
development of Scott’s themes of effectiveness (see Creed, Stout, and Roberts, 
1993 for an exception) and learning (see Turner & Pidgeon, 1997, pp. 191-195 
for an exception). 

Our review of the HRO literature suggests that there is an additional reason 
that a more robust connection has not been made, namely, key HRO processes have 
remained unarticulated. Processes in HROs are distinctive, though not unique, 
because they focus on failure rather than success, inertia as well as change, tactics 
rather than strategy, the present moment rather than the future, and resilience as 
well as anticipation. We will argue later that HROs strive for reliability through 
processes of cognition as much as processes of production. As a result tendencies 
toward inertia are suppressed. It is mindlessness coupled with thoughtless action 
that makes it difficult to cope with a continuous open-ended stream of surprises 
and non-routine events. HRO processes that counteract inertia are potentially im- 
portant because most theorists who discuss organizational learning and adaptation 
overlook them. We elaborate these ideas below. 


The Concept of Reliability 


While the phrase “high reliability” has been annexed by some theorists to convey 
the idea that high risk and high effectiveness can coexist, these same theorists 
have been somewhat circumspect in their attention to just what they mean by 
reliability, where it is localized, and how it is accomplished. This oversight is 
not trivial since reliability itself has been seen as an important competency made 
possible by organization. Commonly defined as the “unusual capacity to produce 
collective outcomes of a certain minimum quality repeatedly” (Hannan & Freeman, 
1984, p. 153), reliability depends on the “lack of unwanted, unanticipated, and 
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unexplainable variance in performance” (Hollnagel, 1993, p. 51). Organizational 
reliability is thought to be achieved through the development of highly standardized 
routines (Hannan and Freeman, 1984, p. 154). In fact, the notion of repeatability 
or reproducibility of actions or patterns of activity is fundamental to traditional 
definitions of reliability. And, over time, routines and reliability have become 
synonymous with one another and also have become linked as an antecedent of 
inertial tendencies that are presumed to reduce adaptive capabilities (Hannan & 
Freeman, 1984). Unfortunately, this taken-for-granted definition (grounded in an 
engineering perspective), while useful for theorizing on more macro levels (e.g., 
population level), is misleading and restrictive at a more micro level. 

The singular focus on repeatability as the primary defining quality of reliability 
in traditional definitions, fails to deal with the reality that reliable systems often 
must perform the same way even though their working conditions fluctuate and 
are not always known in advance. For a system to remain reliable, it must somehow 
handle unforeseen situations in ways that forestall unintended consequences. This 
is where previous definitions of reliability are misleading. They equate reliability 
with a lack of variance in performance. The problem is, unvarying procedures 
can’t handle what they didn’t anticipate. The idea that routines are the source of 
reliability conflates variation and stability and makes it more difficult to understand 
the mechanism of reliable performance under trying conditions. 

What seems to happen in HROs is that there is variation in activity, but there 
is stability in the cognitive processes that make sense of this activity. This pattern 
is found in Schulman’s (1993b: 369) analysis of Diablo Canyon: “The proposition 
that emerges from analyzing Diablo Canyon is that reliability is not the outcome of 
organizational invariance, but, quite the contrary, results from a continuous man- 
agement of fluctuations both in job performance and in overall department inter- 
action” (emphasis in original). To see how this works, consider Woods’ (1988, 
p- 132) description of cognition in complex systems cited in Perrin (1995, p. 156). 
“(To be] opportunistic and flexible in order to detect and to adapt to events 
which require revision of situation assessment and plans...problem solvers 
need to revise their understanding of the situation, their evidence collection and 
evaluation tactics, or their response strategy when new events are detected 
and evaluated. Failures to revise in any of these ways produce what are seen as 
fixation failures.” By separating the variation and stability folded into routines 
and assigning the variation to routines and the stability to processes of cognition, 
we stop treating stable patterns of activity as the source of reliable outcomes. 
Instead, reliable outcomes now become the result of stable processes of cog- 
nition directed at varying processes of production that uncover and correct un- 
intended consequences. 

Unexpected events require revisions of assessments, plans, and tactics but this 
revision is possible only because processes of “understanding,” “evidence col- 
lection,” “detection,” “evaluation,” and “revising” themselves remain stable in the 
face of new events. These stable cognitive processes do the “detecting,” the vari- 
able patterns of activity do the “adapting to events which require revision.” The 
contrasting case is organizations that focus on efficiency. Efficient organizations 
often enact the opposite split, namely, stable activity patterns and variable cognitive 
processes (Starbuck, Greve, & Hedberg, 1978, pp. 114-119). For example, Hynes and 
Prasad (1997) show that prior to the Westray mine explosion on May 9, 1992, which 
killed 26 miners, production routines kept “rolling” while monitoring of methane 
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buildups, spilled fuel, and enforcement of limestone dusting to neutralize coal 
dust, were done only sporadically. Efficient organizations often experience errors 
when they do the same things in the face of changing events, these changes going 
undetected because people are rushed, distracted, careless, or ignorant. Variable 
cognition falls to detect faults in machinery, substandard materials, or declining 
compliance, and these oversights lead to unintended consequences. Thus, to 
understand how organizations organize for high reliability, we need to specify 
what is done repeatedly — in our case this is cognitive processes — and what varies — 
in our case this is routinized activity manifest in performance. 

Our point is simply that each time a routine is re-enacted, it unfolds in a slightly 
different way, a point also made by March and Olsen (1989, p. 38), Feldman 
(1989, p. 130), and Nelson and Winter (1982). In an unknowable, unpredictable 
world, ongoing mutual re-adjustment is a constant, and it is this adaptive activity 
that generates potential information about capability, vulnerability, and the en- 
vironment (e.g., Landau & Chisholm, 1995, p. 70). That information is lost unless 
there is continuous mindful awareness of these variations. By this line of argument, 
unreliable outcomes occur when cognitive processes vary (e.g., are not stable) and 
no longer stay focused on failures, simplifications, recoveries, situations, and struc- 
turing, or when patterns of activity fail to vary and unexpected events are normal- 
ized (Vaughan, 1996). This conceptualization of reliability is more grounded in 
adaptive human cognition and action (Hollnagel, 1993) than is the engineering 
definition that equates reliable outcomes with repetitive cognition and action. 
Furthermore, our conceptualization highlights reliability as an overall goal of the 
system and whether the system, in the global sense, works appropriately; not only 
individual components or sub systems. This distinguishes it from definitions that 
focus on the repeatability or reproducibility of single observable actions. 


The Concept of Mindfulness 


‘To grasp the distinctiveness of HROs, one needs to look more closely at the ways 
in which diverse but stable cognitive processes interrelate in the service of the 
discovery and correction of errors. There has been ample recognition in the lit- 
erature that diverse cognitive processes are associated with high reliability 
organizations. Westrum (1992, 1997), for example, alludes to a “generative” organ- 
ization in which information is actively sought, failures cause inquiry, and new 
ideas are welcomed, a pattern which he refers to as a “license to think” (1992, 
p. 405), acting with “utter probity” (1992, p. 402), and a “protective envelope of 
human thought” (1997, p. 237). Evocative as those images are, their mechanisms 
remain largely unelaborated. The same holds for Klimoski and Mohammed’s 
(1994) thoughtful survey of team cognition, Thordsen and Klein’s (1989) discus- 
sion of team mind, and Hutchins’ (1990) use of connectionism to interpret crew 
interaction in ship navigation. 

While there has been some recognition that cognitive processes are import- 
ant in high reliability functioning, what has been missing from these accounts is a 
clear specification of ways in which these diverse processes interrelate to produce 
effective error detection. When people in HROs focus on failures, tendencies to 
simplify, current operations, capabilities for resilience, and temptations to over- 
structure the system, these concerns cover a broader range of unexpected events. 
As shown in Figure 1, these separate concerns are tied together by their joint 
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PROCESSES 


Preoccupation with Failure 


Reluctance to Simplify 


Interpretations Capability to Discover 
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Manage Unexpected 
Events 


Sensitivity to Operations Mindfulness — > —-» Reliability 


Commitment to Resilience 


Underspecification of 
Structures 


Figure 1: A mindful infrastructure for high reliability 


capability to induce a rich awareness of discriminatory detail and a capacity for 
action. We label this capability mindfulness, following Langer (1989, 1997). It 
is this enriched awareness, induced by the distinctive concerns of HROs with 
potentials for catastrophe, that facilitates the construction, discovery, and 
correction of unexpected events capable of escalation (Rochlin, 1989, pp. 164-165). 
In Langer’s model, the rich awareness associated with a mindful state is expressed 
at the individual level in at least three ways: active differentiation and refinement 
of existing categories and distinctions (Langer, 1989, p. 138); creation of new dis- 
continuous categories out of the continuous streams of events that flow through 
activities (Langer, 1989, p. 157); and a more nuanced appreciation of context and 
of alternative ways to deal with it (Langer, 1989, p. 159). In our extension of this 
model to the group level, we assume that awareness is expressed in at least these 
same three ways as byproducts of the five cognitive processes we discuss later. 

‘To grasp the role of collective mindfulness in HROs, it is important to rec- 
ognize that awareness is more than simply an issue of “the way in which scarce 
attention is allocated” (March, 1994, p. 10). Mindfulness is as much about the 
quality of attention as it is about the conservation of attention. It is as much about 
what people do with what they notice as it is about the activity of noticing itself. 
Mindfulness involves interpretive work directed at weak signals (Vaughan, 1986, 
chap. 4), differentiation of received wisdom, and reframing, all of which can en- 
large what is known about what was noticed. It is the enlarged set of possibilities 
that suggests unexpected deviation that needs to be corrected and new sources 
of ignorance that become new imperatives for noticing. 

Mindfulness in HROs is distinctive because it is closely related to the repertoire 
of action capabilities (Westrum, 1988, p. 8). The close relationship between mind- 
fulness and the action repertoire in HROs is a key to their effectiveness. The 
central idea is found in Westrum’s (1988) discussion of “the ecology of thought.” 
Westrum argues that organizations that are willing to act on specific hazards are 
also organizations that are willing to see those hazards and think about them. Thus, 
when people bring new variables under their control and enlarge their ability to 
act on them, they also enlarge the range of issues they can notice in a mindful 
manner. Conversely, if people are blocked from acting on hazards, it is not long 
before their “useless” observations of those hazards are also ignored or denied, and 
errors cumulate unnoticed. Thus, the richness of a state of mindfulness is 
determined by the richness of the action repertoire. The richness of that action 
repertoire, in turn, is determined partly by the extent to which the cognitive 
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processes are stable and continue to develop and partly by the extent to which 
the repertoire of variable routines that uncover and manage unexpected events 
continues to expand. HROs that are less effective (e.g., Osborn & Jackson, 1988) 
have a more limited range of action repertoires, use fewer of the cognitive pro- 
cesses associated with effective failure-avoidance, and update and enlarge their 
action repertoires less often. 

When fewer cognitive processes are activated less often, the resulting state 
is one of mindlessness characterized by reliance on past categories, acting on 
“automatic pilot,” and fixation on a single perspective without awareness that 
things could be otherwise. As we move away from the better HROs and their pre- 
occupation with failure, we find more organizations that are preoccupied with 
success. While people can be mindful about success, the irony is that this pre- 
occupation tends to encourage simplification and exploitation of existing 
performance routines, adherence to institutionalized categories, and compliance 
with inherited job descriptions, all of which represent acts that are largely mindless 
(Miller, 1993). If artifacts of mindlessness dominate, mindfulness occurs less fre- 
quently which means that small errors with potentially large consequences go 
undetected. This state of affairs is what HROs try to forestall. 

To say that an organization is drifting toward mindlessness is simply another 
way of saying that the organization is drifting toward inertia without consider- 
ation that things could be different. Whether the condition is labeled inertia or 
mindlessness, the important point for organizational theory is that HROs actively 
strive to suppress it, which means they are important sources of insight about the 
conditions under which inertia is not indigenous to organization. Thus, HROs 
with their ongoing mindful renegotiation of routines, provide valuable information 
about ways in which organizations in general might forestall their own drift toward 
inertia by more effectively managing surprises that challenge adaptability. 


Processes of Mindful Organizing 


Our examination of the literature on HROs suggests that the combination of stable 
cognitive processes and variations in action patterns enables the more successful 
HROs to manage unexpected events effectively. These outcomes appear to be 
mediated by a way of being that is fostered by an apparent ongoing focus on failure, 
simplification, current operations, resilience, and underspecified structures, a way 
of being that we refer to as mindfulness. Mindfulness is less about decision making, 
a traditional focus of organizational theory and accident prevention, and more 
about inquiry and interpretation grounded in capabilities for action. Furthermore, 
mindfulness in HROs is not activated solely by novelty, but rather is a persistent 
mindset that admits the possibility that any “familiar” event is known imperfectly 
and is capable of novelty. This ongoing wariness is expressed in active, continuous 
revisiting and revision of assumptions, rather than in hesitant action. 

A state of mindfulness appears to be created by at least five processes that 
we have induced from accounts of effective practice in HROs and from accident 
investigations: 


1. Preoccupation with failure 
2. Reluctance to simplify interpretations 
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3. Sensitivity to operations 
4. Commitment to resilience 
5. Underspecification of structures 


Preoccupation with Failure 


A chronic worry in HROs is that analytic error is embedded in ongoing activities 
and that unexpected failure modes and limitations of foresight may amplify 
those analytic errors. In their study of a nuclear submarine, Bierly and Spender 
(1995, p. 644) found “collective bonds among suspicious individuals,” LaPorte 
in his study of air traffic systems (1996, p. 65) observed “prideful wariness,” 
while Rochlin (1993, p. 14) describes “suspicion of quiet periods.” Schulman in 
his study of Diablo Canyon (1993b, p. 364) describes the chronic worries this 
way: there is “widespread recognition that all of the potential failure modes into 
which the highly complex technical systems could resolve themselves have yet to 
be experienced. Nor have they been exhaustively deduced. In this respect the tech- 
nology is still capable of surprises. In the face of this potential for surprise, there 
is a fundamental reluctance among higher management to put decision or action 
frameworks in place that are not sensitive to the possibilities of analytic error.” 

Worries about failure are what give HROs much of their distinctive quality. 
The distinctiveness arises from the simple fact that failures are a rare occurrence. 
This means that HROs are preoccupied with something they seldom see. Their 
ways of working around this shortfall and the cues they use as substitutes for 
failure, suggest modes of organizational learning that go beyond the simple 
duality of explore versus exploit (March, 1996). If we view failure as an import- 
ant precondition for learning (e.g., Sitkin, 1992), then safe HROs should find it 
tough to learn since they have so few data points of failure. To be preoccupied 
with failure, therefore, is to make do with these less than ideal learning conditions 
and convert them into grounds for improvement. Effective HROs do this in at 
least three ways: by treating any and all failures as windows on the health of the 
system, by a thorough analysis of near failures, and by focusing on the liabilities 
of success. 

If serious failures are rare, one means to get more data points for learning 
is to broaden the number and variety of failures that are given close attention. 
Effective HROs both encourage the reporting of errors (Tamuz, 1994) and make 
the most of any failure that is reported. They remedy a paucity of data with richer 
analysis of the data they do gather (Bierly and Spender, 1995, p. 644). Schulman 
(1993a, p. 34) argued that the more effective nuclear power plants use reliability 
as a proxy for organizational health. We interpret this to mean that any failure, 
regardless of its location, is treated as a window on the reliability of the system as 
a whole. One lapse could be a weak signal that other portions of the system are 
vulnerable. While most organizations tend to localize failure, effective HROs tend 
to generalize it. Carroll (1997) made a similar point when he observed that many 
nuclear power plants attend to small incidents in the belief that the accumulation 
of such incidents increases the probability of a major problem. They act as if there 
is no such thing as a localized failure and suspect, instead, that causal chains that 
produced the failure are long and wind deep inside the system. 

One byproduct of this increased attentiveness to all failures is that in contrast to 
their inconsequential role in traditional organizations, maintenance departments 
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in HROs become central locations for organizational learning (Kmetz, 1984; 
Marcus, Nichols, & McAvoy, 1993, p. 352; Bourrier, 1996). Maintenance people 
come into contact with the largest numbers of failures, at earlier stages of devel- 
opment, and have an ongoing sense of vulnerabilities in the technology, sloppiness 
in the operations, gaps in the procedures, and sequences by which one error trig- 
gers another. These observations enlarge the database for learning and are given 
detailed attention. 

To increase the data points available for learning, effective HROs also en- 
courage and reward the reporting of errors. Rochlin (1993, p. 27) argues that 
HROs are unique because they “self-organize to encourage and reward the self- 
reporting of errors...on the explicit recognition that the value to the organization 
of remaining fully informed and aware of the potentiality for the modality of 
error far outweighs whatever internal or external satisfaction that might be 
gained from identifying and punishing an individual and/or manufacturing a 
scapegoat to deflect internal or external criticism.” Westrum (1992, pp. 405-406) 
emphasized the important lesson conveyed when Wernher Von Braun sent a bottle 
of champagne to an engineer who, when a Redstone missile went out of control, 
reported that he may have caused a short-circuit during pre-launch testing. 
Checking revealed that this had caused the accident, which meant that an expensive 
redesign was avoided. As Westrum (1988, p. 14) observed, “Note here that the 
engineer took two risks: he was not sure what had caused the problem so he was 
advancing a guess; and if he had, he could face sanctions. In most organizations, 
such an admission would have received a very different response.” Landau and 
Chisholm (1995, p. 77) describe a seaman on the nuclear carrier Carl Vinson who 
loses a tool on the deck, reports it, all aircraft aloft are redirected to land bases 
until the tool is found, and the seaman is commended for his actions the next day 
at a formal deck ceremony. Edmondson (1996) found, contrary to her hypotheses, 
that the highest performing nursing units led by skilled and supportive managers, 
had higher detected error rates for adverse drug events than did units that were 
lower on these dimensions. She interprets these results to mean, not that more 
errors were made in the high performing units, but that a climate of openness 
had been created that made people more willing to report and discuss errors and 
to work toward correcting them. Supplementary analysis and observational data 
were found to be consistent with this interpretation. The general point is that, 
one means to learn even though trial and error is limited, is by broadening the set 
of errors that are available from which to learn and by instituting practices that 
encourage people to report all of those errors that are detected. 

To broaden the variety of data points available for learning close attention is 
paid to analyzing near misses. Using as an example a near collision in aviation, 
the issue in a near miss is that “Every time a pilot avoids a collision, the event 
provides evidence both for the threat and for its irrelevance. It is not clear whether 
the learning should emphasize how close the organization came to disaster, thus the 
reality of danger in the guise of safety, or the fact that disaster was avoided, thus 
the reality of safety in the guise of danger” (March, Sproull, & Tamuz, 1991, 
p. 10). Attending to failure in more effective HROs takes the form of seeing the 
reality of danger in a near miss, whereas in less effective HROs it takes the form 
of seeing the reality of safety. 

A third means to learn in the face of limited trial and error is to define as failures 
any dysfunctional response to success. HROs after all are highly successful in the 
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sense that failures are rare. What is distinctive is that it is this very success and the 
temptations that arise from it that define a new form of failure from which HROs 
can learn. These failures that arise as consequences of success include restricted 
search, reduced attention, complacency/inertia, risk aversion, and homogeneity 
(Sitkin, 1992, pp. 234-236). All of these outcomes arise because people expect suc- 
cess to repeat itself. Thus, these outcomes represent dangerous expectations and 
the better systems treat them as proxies for failure. 

Starbuck and Milliken’s (1988, pp. 329-330) analysis of the Challenger disaster 
points to the liabilities of success. “Success breeds confidence and fantasy. When 
an organization succeeds, its managers usually attribute success to themselves or 
at least to their organization, rather than to luck. The organization’s members 
grow more confident of their own abilities, of their manager’s skills, and of their 
organization’s existing programs and procedures. They trust the procedures to 
keep them appraised of developing problems, in the belief that these procedures 
focus on the most important events and ignore the least significant ones.” Under 
the assumption that success demonstrates competence, people drift into com- 
placency, inattention, and habituated routines, which they often justify with the 
argument that they are eliminating unnecessary effort and redundancy. What they 
fail to see is that this pattern increases the likelihood of human errors, and that 
each of the liabilities of success must be detected and opposed. In the more ef- 
fective HROs, complacency is interpreted as a failure of striving, inattention is 
interpreted as a failure of vigilance, and habituation is interpreted as a failure 
of continuous adjustment. Attending to potential failures implicit in success is 
equivalent to acting on the assumption that any current success makes future 
success less probable. 


Reluctance to Simplify Interpretations 


Members of all organizations handle complex tasks by simplifying the manner in 
which the current situation is interpreted. These simplifications, variously referred 
to as worldviews, frameworks, or mindsets, basically allow members to ignore 
data and keep going. This is a common property of all organizing (Turner, 1978). 
However, simplifications are potentially dangerous for HROs because they limit 
both the precautions people take and the number of undesired consequences they 
envision. Simplifications increase the likelihood of eventual surprise. They allow 
anomalies to accumulate, intuitions to be disregarded, and undesired consequences 
to grow more serious. 

The issue in simplification is “whether the simplified diagnosis of the pre- 
sent and likely future situation is accurate enough to enable the organizational 
goals to be achieved without encountering unexpected difficulties that lead on to 
catastrophe. The central difficulty, therefore, lies in discovering which aspects of 
the current set of problems facing an organization are prudent to ignore and which 
should be attended to, and how an acceptable level of safety can be established as 
a criterion in carrying out this exercise” (Turner, 1976, p. 379). Thus, front the 
perspective of work on HROs, perhaps the most crucial fact about organizations of 
all kinds is that they “achieve a minimal level of coordination by persuading their 
decision-makers to agree that they will all neglect the same kind of consideration 
when they make decisions” (Turner, 1978, p. 166). Organizations are defined by 
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what they ignore, which means they are also defined by what can surprise them. 
Traditional organizations tend to overlook the question of what they ignore (e.g., 
Pearson & Mitroff, 1992, p. 55) whereas effective HROs respect this question 
and know more about what they don’t know. 

Since precautions are designed to fit a simplified view of the world, HROs 
tend to restrict their simplifications (Roth, 1997) in order to enlarge the number 
of precautions they enact. Thus, while all organizations make assumptions and 
socialize people to ignore the same things, HROs are distinctive because they make 
fewer assumptions and socialize people to notice more (Xiao, Milgram, & Doyle, 
1997). Many have argued that what sets HROs apart is the effort they make to 
match internal complexity with external complexity (e.g., Meshkati, 1989; Perrin, 
1995, p. 165). To restrain temptations to simplify, HROs cultivate requisite variety 
and assume that it takes a complex system to sense a complex environment. These 
efforts take such forms as diverse checks and balances embedded in a proliferation 
of committees and meetings, frequent adversarial reviews, selecting new employees 
with non-typical prior experience, frequent job rotation, and re-training. 

Simplification is also curbed through negotiated complexity (Schulman, 1993b, 
p. 361). In HRO’s, “not only are a wide range of informal interorganizational 
agreements observable, their negotiation and continual renewal are recognized 
and embraced formally in the organization as an integral foundation of its safe and 
reliable operation” (Schulman, 1993b, p. 362, emphasis in original). In this way, pro- 
cedures become increasingly complex rather than simple. This process of renewal, 
revision, or rejection means that “each procedure encapsulates new experience 
(often won the hard way through error)” (Schulman, 1993b, p. 362). The process of 
constantly tending to procedures mitigates complacency and rigidity. 

Schulman (1993b) defines requisite variety as “conceptual slack” by which he 
means “a divergence in analytical perspectives among members of an organization 
over theories, models, or causal assumptions pertaining to its technology or pro- 
duction processes” (Schulman, 1993b, p. 364). This divergence of perspectives is 
not about what the organization is doing, but rather about how it is going about it. 
Divergent perspectives provide the organization with a broader set of assumptions 
that sensitize it to a greater variety of inputs. The price of this expansion is that it 
can increase the incidence of disagreement and conflict when it comes time to act. 
HROs are distinguished not just by their diverse views, but also by the mechanisms 
they institutionalize to manage disagreements among those who hold these diverse 
views. Bourrier, in her observation of nuclear power plants (1996, p. 105), puts it 
this way: “Cooperation is constantly elaborated through the mutual adjustments 
of the strategies of individuals who continually re-negotiate their participation 
inside the organization, trying to get control of what is relevant for their tasks.” 
We emphasize the point about the centrality of negotiation because it is missed so 
often, even among scholars of HROs. What they miss is that when people convert 
divergent perceptions into action, they may focus only on those perceptions 
that are held in common among the divergent thinkers (Sutcliffe, 1994). Even 
though diverse groups have more information available than more homogeneous 
groups, communication patterns and cognitive limitations lead to a situation 
where unique information does not get shared (e.g., see Larson et al., 1996). 
And it is the divergence not the commonalities, that holds the key to detecting 
anomalies. Thus, there is a premium on interpersonal skills (e.g., Schulman, 1993; 
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Weick and Roberts, 1993), mutual respect (Weick, 1993a), norms that curb bull- 
headedness, hubris, headstrong acts, and self-importance (Schulman, 1993a, 
p. 45), continuous negotiation (Perrin, 1995), reaccomplishment of trust, and 
simultaneous cultivation of credibility and deference (Bierly & Spender, 1995). 

‘To preserve awareness of simplifications, HROs often implement a novel form 
of redundancy. Normally, redundancy in any system means that there is duplication 
and backups (Landau, 1969; Lerner, 1986; Husted, 1993). This is true of high re- 
liability systems. But redundancy in HROs also takes the form of skepticism and 
is one of the reasons that trust has a problematic stature in this literature (Bierly 
and Spender, 1995, p. 644). When a report is met with skepticism and the skeptic 
makes an independent effort to confirm the report, there are now two observations 
where there was originally one. The second set of observations duplicates and 
backs up the first set and may itself be double-checked by still another skeptic. This 
skepticism may counteract the potential complacency that redundant systems may 
foster. Redundancy involves cross checks, doubts that precautions are sufficient, 
and wariness about claimed levels of competence. Conceptual slack is also a form 
of skepticism since it represents concern that when others see what they believe, 
both their seeing and believing miss a lot. Concomitant with trust is the belief 
that all humans are fallible, and that skeptics improve reliability. 


Sensitivity to Operations 


Sensitivity to operations in HROs is often described by a phrase borrowed from 
the Navy, “having the bubble” (Roberts & Rousseau, 1989). Rochlin (1997, p. 109) 
describes the phenomenon this way: “Those who man the combat operations 
centers of US Navy ships use the term ‘having the bubble’ to indicate that they 
have been able to construct and maintain the cognitive map that allows them to 
integrate such diverse inputs as combat status, information sensors and remote 
observation, and the real-time status and performance of the various weapons 
and systems into a single picture of the ship’s overall situation and operational 
status.” The notion of “having the bubble is similar to the notion of “situational 
awareness” (Endsley, 1997, p. 270) defined as “the perception of the elements in 
the environment within a volume of time and space. The comprehension of their 
meaning and the projection of their status in the near future.” Both phrases refer 
to the integrated big picture of operations in the moment, an accomplishment that 
is difficult to maintain. Whereas situational awareness refers generically to the 
big picture that any operator forms, having the bubble refers to an effortful 
achievement of a high level of situational awareness. LaPorte (1988, p. 224) puts 
it this way: in HROs “the effort and intensity of purpose required to build what 
we sometimes characterize as the ‘bubble’, the state of cognitive integration 
and collective mind that allows the integration of tightly-coupled interactive 
complexity as a dynamic operational process, is enormous.” 

If someone has the bubble at all times in HROs, then catastrophic failures are 
forestalled by large numbers of ongoing small adjustments that prevent errors 
from cumulating (Wildavsky, 1991, p. 26). To forestall cumulation is to reduce 
the likelihood that any one error will become aligned with others and interact in 
ways not previously seen. Furthermore, maintaining the bubble is another way to 
describe what it means to act thinkingly in HROs. When people have the bubble, 
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ongoing action occurs simultaneous with attention, and people act thinkingly with 
wisdom and heed (Meacham, 1983; Weick, 1993a, 1998). 

The importance of sensitivity to current operations is reflected in much of the 
terminology associated with HROs. Descriptive words such as struggle for alert- 
ness, misinterpretation, overload, decoys, distraction, mixed signals, surprise, 
vigilance, near misses, warnings, anomalies, lookouts, clues, and neglect, all portray 
the concern to catch errors in the moment. Dangers inherent in the loss of this 
sensitivity can be illustrated by a totally new class of problems called “automation 
surprises” (Miller & Woods, 1997, p. 143). These surprises occur, for example, in 
automated cockpits when pilots command the aircraft to do one thing, and it does 
something else because on-board computers are integrating a different set of inputs 
in a different way. The crew finds itself in the unfamiliar position of asking “now 
what is it doing? what will it do next?” and losing valuable time and separation 
among aircraft while seeking an answer. Situational awareness and sensitivity to 
operations reduce the incidence of automation surprises and shorten the period 
of inaction. 

One obstacle to the maintenance of broad operational awareness is the danger 
of production pressure and overload. For example, the grounding of the carrier 
Enterprise on Bishop Rock (Roberts and Leuschner, in press) was attributed in part 
to saturation of the captain by multiple demands which led him to misinterpret a 
red light that warned of shoal waters and to see that light instead as a white light 
warning of a fishing net buoy. More effective HROs tend to be more self conscious 
in dealing with pressures of overload and to “exhibit extraordinary sensitivity to 
the incipient overloading of any one of its members” (Reason, 1990, p. 483) as 
when air traffic controllers gather around a person working a very high amount of 
traffic and look for danger points. The issue of awareness of production pressure 
and its effects on judgment and performance is crucial, because many organizations 
have raised production pressure and overload through downsizing. 

Endsley (1995) suggests that situation awareness emerges from the perception 
of elements in the environment, the synthesis of discrete elements in order to 
achieve comprehension of the current situation, and the projection into the future 
to envision possible future states of the situation. Because HROs involve complex 
technologies operating in complex environments, each of these situation awareness 
dimensions depends on the sharing of information and interpretations between 
individuals. The expression “having the bubble” may actually mislead to the extent 
that it suggests that an individual possesses the one correct representation of a 
complex environment. The limited cognitive resources of the individual prevent 
the development of a cognitive map that accurately registers the entirety of an 
HRO and its operating environment. Even sophisticated cognitive maps will have 
limited range and incorporate a potentially high level of generalization or simplifi- 
cation. Having the bubble, when achieved, is typically a shared accomplishment and 
bubbles of varying focus and range may coexist in a high-functioning HRO. 

Roth’s (1997) studies of operator decision making in simulated nuclear power 
plant emergencies illustrate the ways in which effective HROs retain sensitivity to 
operations. Sensitivity to operations is achieved through a combination of shared 
mental representations, collective story building, multiple bubbles of varying size, 
situation assessing with continual updates, knowledge of physical interconnections 
and parameters of plant systems, and active diagnosis of the limitations of 
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preplanned procedures. The value of her work lies in the articulation of the 
ways in which higher-level cognitive activities, social construction of coherent 
explanations, and knowledge of the physical plant, all produce mindfulness in 
the moment. 

Roth’s picture of effective operational HRO functioning, reveals important 
details that are not tapped by the simplified processes implied by the seductive 
phrase, “situation awareness.” It is clear, for example, that operators “actively 
generate situational assessments” (plural) (Roth, 1997, p. 178) for the symptoms 
they notice, revising each assessment when they fail to observe symptoms expected 
on the basis of that assessment. They were not simply “aware” of the situation but 
searched for a “coherent explanation that minimized the number of separate faults 
that need to be postulated” (p. 178). These coherent explanations often consist 
of “story building” (p. 177) and monitoring to see “whether actions indicated 
in procedure steps made sense in the context of the particular event” (p. 180). 
Operators used knowledge of the assumptions and logic that underlie preplanned 
procedures to deal with situations not fully covered by the procedure (p. 181). 
There was an ongoing effort “to determine whether observed plant behavior was 
the result of known influences on the plant, such as manual and automatic actions 
and known malfunctions, or was unexpected and signaled an unidentified plant 
malfunction” (p. 179). This emphasis on actual operations and plant characteristics 
is noteworthy across effective HROs and is the reason why we chose the label 
“sensitivity to operations” to capture this process. Roth describes knowledge of 
plant characteristics this way: “crews needed to utilize mental models of phy- 
sical plant systems and to reason qualitatively about expected effects of different 
factors influencing plant state in order to localize plant faults and identify actions 
to mitigate them” (p. 181). Finally, Roth also observed that efforts to improve the 
accuracy of representations were social and interactive: “[W]e saw repeated cases 
where operators stopped to discuss as a group whether the procedure path they 
were following would eventually lead them to take the actions they recognized 
to be important for safe recovery of the plant” (p. 180). 

What becomes clear in Roth’s work is that images such as “the bubble” and 
“situation awareness” are overly static and are neither deep enough nor dynamic 
enough to capture continuous formulating, monitoring, story building, and 
acting. Although our phrase “sensitivity to operations” highlights only the first of 
Endsley’s (1995) three phases of situation awareness — perception — the above de- 
scription underscores the importance of integration and extrapolation as well. 
Further, it appears to us that integration and extrapolation are actually products of 
the mindfulness created by all five processes, rather than activities tied specifically 
to operations. It is collective knowledge of failures, details, potentials for recovery, 
and relevant past experience, gathered into mindful processing, that provides the 
context within which present operations either make sense or are reconstructed 
to make sense. 


Commitment to Resilience 


The maritime industry is renowned for its low reliability organizations (e.g., 
Perrow, 1984, chap. 6). For example, in the case of tanker ship oil spills Nalder 
(1994, p. 260) expressed skepticism that requiring double hulls on these ships 
would do much to prevent environmental damage: “Double hulls will not solve 
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the problem if ships carry the maximum amount of oil with the minimum amount 
of steel and people; if vessel-traffic systems exist in only a few waterways of the 
world; if standards for crew training do not change; if regulators are fragmented 
and weak; and if the profit margin squeezes out safety. History show that things 
return quickly to business as usual in this tanker trade.” While the “maritime 
business is one huge accident waiting to happen all the time” (Nalder, 1994, 
p. 118), in one regard mariners are exemplary. They are accustomed to resilience. 
They have no choice but to rely on their own coping skills when most of their 
operations consist of “blue-water” cruising away from land and rescuers and spare 
parts and expert diagnoses. (See Danton, 1991, for discussion of how to cope 
with such conditions as collision damage, heavy weather damage, loss of rudder, 
stranding, handling disabled vessels.) If a rudder breaks, if power goes off, the crew 
is dependent on its own resourcefulness to do something right now, even if it is 
only to drop anchor and buy time to figure out the problem. Most HROs engage 
in their own form of blue-water operations when they stumble onto problems 
far from informed rescuers, uncommitted resources, and expertise, and have no 
choice but to respond to the unexpected in real-time. 

Earlier, we noted that reliable performance in the face of unexpected events was 
achieved at Diablo Canyon through “continuous management of fluctuations.” 
In that earlier discussion we focused on the word “fluctuations” and argued that 
variation rather than invariance in reliability-enhancing activities was necessary to 
cope with the unexpected. Here we want to focus on the equally important word 
“management” because it makes clear that people deal with surprises, not only by 
anticipation that weeds them out in advance, but also by resilience that responds to 
them as they occur. Furthermore, to manage a surprise is to contain it rather than 
eliminate it (Schulman, 1993b, p. 369). In the case of Diablo Canyon, both resilient 
containment and reactive responsiveness are made possible by continuous rein- 
forcement of three “perishable” values: credibility, trust, attentiveness (Schulman, 
1993b, pp. 365-368). 

Effective HROs tend to develop both anticipation and resilience in the sense 
defined by Wildavsky (1991, p. 77). Anticipation refers to the “prediction and pre- 
vention of potential dangers before damage is done,” whereas resilience refers to 
the “capacity to cope with unanticipated dangers after they have become manifest, 
learning to bounce back.” Unlike effective HROs, traditional organizations tend 
to lean heavily toward one or the other of the two, typically toward anticipation of 
expected surprises, risk aversion, and planned defenses against foreseeable risks. 

While it is to be expected that HROs would devote enormous attention to 
anticipating possible failure modes (Wildavsky in fact uses nuclear power plants 
to epitomize over-reliance on anticipation, 1991, p. 147), it may be less obvious 
that HROs develop capacities for resilience. Resilience is not only about bouncing 
back from errors, it is also about coping with surprises in the moment. It is im- 
portant to retain both connotations of resilience to avoid the idea that resilience is 
simply the capability to absorb change and still persist. To be resilient also means 
to utilize the change that is absorbed. The best HROs don’t wait for an error to 
strike before responding to it. Rather, they prepare for inevitable surprises “by ex- 
panding general knowledge and technical facility, and generalized command over 
resources” (Wildavsky, 1991, p. 221). Even though a central tension in the HRO 
literature is the possibility that once a mistake starts to amplify in a system, that 
error may be the system’s last trial, it is clear that HROs accept the inevitability 
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of error. HROs acknowledge the reality of fallible humans, murky technology 
(Vaughan, 1996, p. 200), and narrow specialties. To cope with this reality they pay 
attention both to error-prevention and to error-containment. 

An example of a commitment to resilience is the capability on aircraft carriers 
to contain emerging crises through informal “epistemic networks” (Rochlin, 
1989, pp. 161-168). This form of resilience materializes when events get outside 
of normal operational boundaries and knowledgeable people self organize into 
ad hoc networks to provide expert problem solving. These networks, which have 
no formal status, dissolve as soon as normalcy returns. Bourier (1996, p. 105) de- 
scribes these structures as “informal latent networks activated only in the face of 
uncertainties and rapidly developing contingencies as a supplement to the normal 
patterns of formal hierarchy and compliance with strict roles.” The value of these 
networks is that they allow for rapid pooling of cognitive knowledge to handle 
events that were impossible to anticipate. Thus epistemic networks represent a 
strategy for flexible crisis intervention that enables systems to deal with irreducible 
uncertainty and imperfect knowledge. They are also an ideal example of the gen- 
eralized, uncommitted resources that are necessary if one is to cope in a resilient 
manner with the unexpected (Wildavsky, 1991, p. 85). 

The commitment to resilience in HROs is also visible in their formal support 
for improvisation (see Bourier, 1996, p. 109). To understand the counterintuitive 
idea that improvisation co-exists with potentials for catastrophe, recall the argu- 
ment made earlier (p. 90) that organizations that are able to act on hazards are also 
able to see those hazards and think about them. In the earlier discussion we implied 
that the addition of specific actions enabled people to recognize new issues in a 
mindful manner. Here, we want to make the additional observation that effective 
HROs also have the capability to recombine actions already in their repertoire into 
novel combinations. And the possibility of recombination enlarges the size of the 
action repertoire just as surely as does the addition of specific actions. With an 
extended range of action goes an extended range of perception of new threats 
(Jervis, 1976; Weick, 1988). Theoretically, a system with a well-developed cap- 
ability for improvisation should be able to see the threatening details in even the 
most complex environment, because, whatever they discover, will be something 
they can do something about. The range of possible action, and, by implication, the 
range of possible things that can then be noticed, are both extended if HROs 
develop competence at recombination and bricolage (Levi-Strauss, 1966; Harper, 
1987; Weick, 1993b, pp. 351-353). As Wildavsky makes clear, this is the ultimate 
form of resilience: “Improvement in overall capability, i.e., a generalized capacity 
to investigate, to learn, and to act, without knowing in advance what one will be 
called to act upon, is a vital protection against unexpected hazards” (Wildavsky, 
1991, p. 70). 

Finally, resilience also takes the form of ambivalence toward the applicability 
of past practice. HROs, unlike most organizations, are able simultaneously 
both to believe and doubt their past experience (Weick, 1969, pp. 86-96; 1979, 
pp. 217-224). Simultaneous belief and doubt is important for adaptive action 
when a hazard is encountered, as Ryle (1979, p. 129) makes clear: “(T)o be thinking 
what he is here and now up against, he must both be trying to adjust himself to 
just this present once-only situation and in doing this to be applying lessons 
already learned. There must be in his response a union of some Ad Hockery with 
some know-how. If he is not at once improvising and improvising warily, he is 
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not engaging his somewhat trained wits in a partly fresh situation. It is the pitting 
of an acquired competence or skill against unprogrammed opportunity, obstacle 
or hazard.” 


Underspecification of Structures 


In our analysis of high reliability organizing we confronted the paradox that the 
adoption of orderly procedures to reduce error often spreads errors around, an 
observation made earlier by Turner (1978, p. 180). Turner (1978) described a 
manufacturing firm, Evans Medical that made sterile fluids for hospitals that 
were distributed through an efficient distribution network. When in 1971 Evans 
made a batch of dextrose infusion fluid that was not sterilized adequately, and in- 
formation about the low preparation temperature was ignored, that same efficient 
distribution network sent the contaminated fluids to several British hospitals 
where “untoward reactions” (Turner, 1978, p. 108) were immediately observed. 
The reliable system insured that the contaminated fluids got to the hospitals 
swiftly with their contamination intact. Vaughan (1996, p. 65) also highlights this 
paradox in her description of how the orderly routines put in place at NASA 
(e.g., the five step process to handle deviations) allowed the erosion of O-rings to 
continue across more launches and be accepted as normal by more units than if 
NASAs procedures had been less orderly. In both cases, an early error was amp- 
lified by an orderly system. 

We interpret these data to mean that effective HROs are sometimes failure-free 
in spite of their orderliness, not because of it. Any orderly hierarchy can amplify 
errors, especially when those miscues occur near the top (Turner, 1978, p. 187). 
Higher level errors tend to pick up and combine with, lower level errors, which 
makes the resulting combination harder to comprehend and more interactively 
complex. It is the very reliability that HROs cultivate, that makes it possible for 
small errors to spread, cumulate, interact, and trigger serious consequences. 

In the face of such dangers, HROs gain flexibility by enacting moments of 
organized anarchy (Rasmussen & Batstone, 1989; Perrow, 1994b, p. 216; Vaughan, 
1996, pp. 200, 203). Changes are made that move the organizations in the direction 
of a garbage can structure (Cohen, March, & Olsen, 1972). In a garbage can, prob- 
lems, solutions, decision makers and choice opportunities are independent streams 
flowing through a system. These streams become linked by their arrival and 
departure times and by any structural constraints that affect which problems, 
solutions, and decision makers have access to which opportunities. In an absolute 
garbage can there are no structural constraints, so solutions become linked to 
problems and decision makers become linked to choices, primarily by their joint 
presence in the same moment (March & Olsen, 1986, p. 17). This emphasis on tem- 
porality contrasts with a more common organizational emphasis on consequences. 
In a system held together by close attention to consequences, “wanting something 
leads to doing something connected to the want, and doing something leads to 
consequences related to the intention” (March & Olsen, 1986, p. 17). In garbage 
cans, coexistence in time, as opposed to rational intention or hierarchical position 
tends to determine problem solving processes. 

Effective HROs achieve flexibility simultaneously with orderliness by enact- 
ing partial garbage cans. They do so by opening the access to what is normally a 
hierarchical authority and decision structure. In a closed hierarchical structure, 
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important choices are made by important decision makers, and important decision 
makers can participate in many choices. What is distinctive about effective HROs 
is that they loosen the designation of who is the “important” decision maker in 
order to allow decision making to migrate along with problems. When HROs 
move in the direction of a more garbage can like structure, people loosen the filters 
on who gains access to what with the result that hierarchical rank is subordinated 
to expertise and experience. When problems and decision rights are both allowed to 
migrate, this increases the likelihood that new capabilities will be matched 
with new problems. As a result, a wider range of capabilities and solutions gain 
access to a wider range of problems. Expertise at the bottom of the pyramid may 
rise temporarily to the top when the filter of formal position is loosened. This 
depiction of how HROs enact flexibility is supported by field research. With 
respect to aircraft carriers Roberts observed: “[D]ecisions are pushed down to 
the lowest levels in the carriers as a result of the need for quick decision making. 
Men who can immediately sense the potential problem can indeed make a quick 
decision to alleviate the problem or effectively decouple some of the technology, 
reducing the consequences of errors in decision making. The ability of any man 
on the deck to call it foul, thereby enabling some of the extreme time pressure 
to be reduced and decisions to be made quickly is an example of the behavior in 
these organizations....[M]any events in [HROs] are unique. Uniqueness coupled 
with the need for accurate decisions leads to decisions which ‘search’ for the 
expert and migrate around the organization. The decisions migrate around these 
organizations in search of a person who has specific knowledge of the event. This 
person may be someone who has a longer tenure on the carrier or in the specific 
job” (Roberts, Stout, & Halpern, 1994, p. 622). Similarly, in nuclear power plants 
Bourrier (1996, p. 109) “found that the most important characteristic [during a 
planned outage] is the formal delegation of power to craft personnel supported 
by a nearly complete availability of top-management at all times. By being a very 
flexible and adaptive organization, any problem can rapidly receive the attention 
it requires at all levels of the organization.” 

This enactment of more anarchic modes of functioning by the loosening of 
hierarchical constraints is facilitated by the mindful system in place in HROs. As 
discussed, when effective HROs’ focus on failure they treat every signal as if it 
were novel. This generates the attentiveness necessary to link expertise with prob- 
lems, solutions, and decisions in the moment. Because they are mindful of failure, 
this also preserves awareness of consequences. Mindfulness, then, is attuned to 
timing as well as to consequences, which means that a mindful system counter- 
acts the typical flaws in garbage can decision making of decisions made by flight 
and oversight. 

The shift to anarchy is part of the ongoing project of mindful action. When 
people examine an anomaly, they turn to others in an effort to understand what the 
anomaly means. This turn is a subtle loosening of hierarchy in favor of expertise. 
The “agency” that triggers this loosening is not an edict from the top, but rather 
a collective, cultural belief that the necessary capabilities lie somewhere in the 
system and that migrating problems will find them. In a mindful system, structure 
is a variable and activity of structuring is a constant. This is just another way of 
saying that routines and designs are fluid. Invariant mindfulness grasps both 
anomalous events and structural constraints that make it difficult to comprehend 
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the meaning of those anomalies. To grasp these limits mindfully is to counteract 
them with consultation that is less hierarchical. To loosen the filter of hierarchy 
is to spread the troublesome cues around and to expose them to a more varied set 
of capabilities. When filters are loosened, people also pay more attention to inputs 
in the moment, they are more sensitive to their time of arrival, and processes are 
more influenced by temporal connections. This heightened sensitivity to temporal 
sorting decouples problems from high ranking decision makers, allows problems 
to migrate, and allows a wider variety of people to make sense of novel cues and 
determine whether they signify a problem or a transient event. 


Discussion 


We started with the observation that HROs are important because they are 
harbingers of adaptive organizational forms for an increasingly complex environ- 
ment. They provide a window on a distinctive set of processes directed toward 
fostering effectiveness that can unfold in all organizations. It is important to 
reiterate that our goal is not to minimize what is distinctive about HROs. Instead, 
we want to use that distinctiveness as the occasion to see all organizations in a 
different manner and to suggest a different set of processes that influence their 
effectiveness. HROs remain the anchor of this exercise in generalization, but we 
believe that everyday organizations increasingly display some of the character of 
HROs. Therefore, we need to revise our theories of organization so that they are 
more sensitive to the themes outlined here. The need to do so is driven by the fact 
that longer term environmental conditions such as increased competition, higher 
customer expectations, and reduced cycle time create unforgiving conditions with 
high performance standards and little tolerance for errors. These conditions 
are likely to continue, as environments become more competitive, uncertain, 
turbulent, and complex (D’Aveni, 1994). Many organizational settings contain a 
million accidents waiting to happen, but most organizations don’t see things that 
way. As organizations are driven to squeeze slack out of their operations through 
downsizing or mergers or resource constraints, or through complex distributed 
computer technologies (Shin and Sung, 1995; Rochlin, 1997), they come to exhibit 
the tightly-coupled, interactively complex profile of many HROs (Weick, 1990a). 
The important question is are those transformations accompanied by increased 
capability for mindfulness? 

There are a number of continuties between HROs and non-HROs. For ex- 
ample, failures that occur in HROs and non-HROs alike are similar in the sense 
that some event disrupts prevailing cultural assumptions about the efficacy of 
current precautions. These failures can be called failures of foresight, since it is 
likely that some forewarning was available and some avoiding action was possible 
(Turner, 1976, p. 380). Because the incident was potentially foreseeable and avoid- 
able, this suggests that the precautions were not as adequate as they were thought 
to be. When failure is defined as “an event, concentrated in time and space, 
which threatens a group with unwanted consequences as a result of the collapse 
of precautions which had hitherto been culturally accepted as adequate” (Turner, 
1976, p. 380), the common features across both HROs and non-HROs are blind 
spots induced by cultural presumptions, the collapse of precautions, concentrated 
triggering of a visible disruption, and unwanted consequences. 
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Further continuities are implicit in the fact that the five processes we discuss 
can counter the dreaded combination of interactive complexity and tight coupling 
associated with normal accidents (Perrow, 1984). Mindfulness both increases the 
comprehension of complexity and loosens tight coupling. People preoccupied 
with failure comprehend more of the potential complex interactions in a system 
and create alternative paths for task performance that loosen couplings. People 
who simplify reluctantly pay close attention to the details of complexity rather 
than abstract them away and see more components that can be rearranged in 
more ways to avoid tight invariant sequences. People who maintain sensitivity to 
operations see more interconnections and comprehend more complexity in the 
moment which enables them to make adjustments that loosen time-dependencies, 
introduce redundancy, and in general, loosen tight coupling. People who develop 
capabilities for resilience stay attuned to unfolding events for longer time intervals 
which increases the likelihood that they will be able to comprehend puzzling 
interaction. Resilient systems also create slack resources and alternative means to 
a goal, both of which loosen couplings. And people who loosen hierarchical access 
structures increase the comprehension of complexity by marrying problems more 
closely and more quickly to experience and expertise, and reduce the likelihood 
of tightened coupling by isolating problems earlier in their development before 
they spread and constrain other system properties. 

When we propose these five ways in which mindfulness counters normal 
accidents, we differ from other analysts such as Perrow and Sagan because we do 
not treat technology as a given that dominates organizational life through its own 
imperatives. Instead we treat technology as an equivoque (Weick, 1990a), as a 
sequence of events that can be understood more fully, and as a sequence of events 
that can also be interrupted, redirected, isolated, loosened, slowed, patched, halted, 
accelerated, etc. We see technology less as an intractable technological imperative 
and more as a controllable option if it is engaged by effortful, continuous collective 
mindfulness enacted by smart, trusting, trustworthy, self-respecting (Campbell, 
1990) people willing and able to negotiate the differences among their diverse 
views under intense time pressure. We realize how big that “if” is. We are mindful 
that engaged collective mindfulness is a complex and rare mix of human alertness, 
experience, skill, deference, communication, negotiation, paradoxical action, 
boldness, and caution. Which is why infallibility is so hard to achieve. But we are 
also mindful that effective HROs do exist and that they are distinguished by the 
form of their fallibility. Effective HROs are known by their capability to contain 
and recover from the errors they do make and by their capability to have fore- 
sight into errors they might make. Both capabilities serve to illuminate complex 
interactions, loosen tight couplings, and insure that complex, tightly coupled 
technologies do not automatically dominate outcomes. 

There are also continuities between HROs and non-HROs in consequences, 
an observation that may be less obvious. HROs with their consequences on a 
catastrophic scale may seem irrelevant to organizations in which people shuffle 
papers and lose a few, attend meetings and solve nothing, catch airplanes and miss 
connections, conduct briefings and persuade no one, evaluate proposals and miss the 
winners, and meet deadlines for projects on which the plug has been pulled. We 
have argued throughout that the magnitude of consequences is not as crucial 
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in conceptualizing HROs as is the nature of their cognitive processes and the 
likelihood that those processes induce a state of mindfulness. 

This is not to dismiss consequences as a defining feature of high reliability, 
since it was their inclusion originally that set these systems apart. But those con- 
sequences varied enormously in the range of their severity (Three Mile Island 
killed no one while Bhopal killed thousands and Challenger killed seven). If people 
wish to remain attentive to consequences in their conceptualization of reliability, 
then they should put those consequences on the same scale as the activities being 
observed. To halt an assembly line is not an absolute catastrophe, but it is a catas- 
trophe relative to what the foreman expects not to fail and for which she or he takes 
precautions. The failure of those precautions can cause reputational harm and 
end careers. A visit from Mike Wallace to a CEO’s office is not an absolute catas- 
trophe in the sense of producing fatalities, but it can affect markets, share price, 
legitimacy, and liability, all of which the CEO counted on not to fail given the 
precautions that were envisioned. To put catastrophes on the same scale as one’s 
tasks is to see the potential for big trouble arising from small moments when 
intentions fail, when a surprise occurs, or when a near miss and good luck reveal un- 
expected danger. Small though those moments may be, they recapitulate on their 
own scale what happens in larger HROs on a larger scale. And small moments on 
any scale can cumulate, enlarge, and have disproportionately large consequences 
as complexity theorists keep telling us. 


Theory Refinements 


Among the many issues raised earlier that need further conceptual develop- 
ment and empirical research, we would single out four for their centrality to 
organization theory: effectiveness, learning, meaningful levels of analysis, and 
requisite variety. 


Effectiveness 


HROs are important to mainstream organizational theory because they are “non- 
normal organizational performance situations” (Whetten & Cameron, 1994, 
p. 136) that enrich our conceptualization of organizational effectiveness. At first, 
HROs seem to be simply one more ideal type of organization whose effectiveness 
is measured by a single universalistic criterion. Thus, the ideal HRO that maxi- 
mizes reliability takes its place alongside the ideal bureaucracy that maximizes ef- 
ficiency, the ideal cooperative system that maximizes need satisfaction, or the ideal 
natural system that maximizes resource acquisition. The problem of course is that 
a universalistic criterion of effectiveness is insensitive to the diverse environmental 
conditions and the diverse preferences of strategically critical constituencies with 
which any organization contends (Cameron, 1995, p. 393). Furthermore, reliability 
is not the full story of effectiveness in either HROs or organizations in general. 
“[T]o the extent that some researchers persist in claiming that HROs are unique, 
they fail to recognize that reliability is really one of many concepts that fall under the 
rubric of organizational effectiveness. HROs seek to operate effectively using their 
own distinctive criteria much as McDonald’s makes good food and clean bathrooms 
its endeavor” (Creed, Stout, & Roberts, 1993, pp. 56-57). 
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Sensitivity to simultaneous conflicting definitions of effectiveness is regained 
when observers pay closer attention to the paradoxical logic of effective organ- 
izational performance. And it is here where HROs aid articulation. Paradoxical 
logic is necessary to capture “the inherently paradoxical nature of organizational 
life. Administrators must not only make tradeoffs between day-to-day competing 
demands on the organization’s resources, but more importantly, they must balance 
competing expectations regarding the core identity of the organization as an 
institution. From this point of view, effective organizations are both short-term 
and long-term focused, flexible and rigid, centralized and decentralized, goal and 
resource control oriented, concerned about the needs of members and the de- 
mands of customers” (Whetten & Cameron, 1994, p. 141). Cameron (1986) found 
that the presence of simultaneous opposites created the highest level of effective- 
ness in recovering institutions of higher education, organizations that are loosely 
coupled and interactively complex in Perrow’s (1984, p. 97) matrix of the “organ- 
izational world.” HROs suggest that the acceptance of paradox continues to create 
high effectiveness when systems become more tightly coupled and more inter- 
actively complex. As we have seen, HROs pursue simultaneous opposites such as 
rigidity and flexibility, confidence and wariness, compliance and discretion, antici- 
pation and resilience, expertise and ignorance, and balance them rather than try 
to resolve them. 

Rochlin (1993, p. 24) neatly summarizes some of the paradoxes of effectiveness 
in HROs: HROs “seek an ideal of perfection but never expect to achieve it. They 
demand complete safety but never expect it. They dread surprise but always 
anticipate it. They deliver reliability but never take it for granted. They live by 
the book but are unwilling to die by it. If these beliefs seem wonderfully contra- 
dictory, those who express them are under no particular pressure to rationalize 
their paradoxes, indeed, they seem actively to resist such rationalization.... This 
lack of goal rationalization extends to the organizational as well as the individual 
level. The observed deliberate, and often self-conscious, effort to create and 
maintain multiple modes of decision making and duplicative error searching re- 
gimes, and to hold differing perspectives and rank-ordering of preferences by 
different groups is a manifestation of collective organizational response rather 
than individual behavior. Such representational ambiguity is implicitly (and 
sometimes explicitly) acknowledged and accepted by the organization, not just 
as part of the cost of maintaining performance levels, but as an active contributor 
to problem solving.” 

HROs, however, provide more than just a comparative window on the role of 
paradox in effectiveness. They also depict an important sense in which effective- 
ness is defined by conditions to be avoided rather than conditions to be sought. As 
Roberts and Creed (1993, p. 254) put it, “reliability-enhancing organizations iden- 
tify sets of outcomes they continually work never to experience.” Effectiveness 
defined in terms of avoidance necessitates much more mindfulness, capability, and 
alertness than does effectiveness defined in terms of approach. The complexities 
inherent in effective avoidance affect culture as well as perception in HROs. In the 
case of culture, “Reliability, as a cultural value [in HROs], is oriented against in- 
effectiveness rather than toward effectiveness. If this is true, it may be that these 
organizations — existing as they do in an era of continuous technological change — 
can enjoy no equilibrium state and are characterized by continually changing cul- 
tures striving to avoid a non-goal” (Roberts & Creed, 1993, p. 252). In the case 
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of perception, Schulman (personal communication, 6/25/97, p. 2) has distilled 
his research on Diablo Canyon into these two propositions: “(1) The major 
determinant of reliability in an organization is not how greatly it values reliability 
or safety per se over other organizational values, but rather how greatly it disvalues 
the mis-specification, mis-estimation, and misunderstanding of things; (2) All else 
being equal, the more things that more members of an organization care about 
mis-specifying, mis-estimating and misunderstanding, the higher the level of 
reliability that organization can hope to attain.” 

If HROs strive to reduce mis-specification, then they need structural and cog- 
nitive mechanisms that encourage the sensing and organization of detail. These 
mechanisms need to be complex in order to register complexity. But they also 
need to keep that complexity unintegrated to preserve its detail. Efficiency and 
simplification encourage integration and discourage unintegrated complexity. To 
pursue unintegrated complexity, however, is to run the risk of appearing disorderly, 
messy, and unsafe, which could jeopardize legitimacy. The safest organizations may 
look the most dangerous. And vice versa. There may be a fine line between messes 
that promote requisite variety and messes that undermine it. Effective HROs 
manage this tension artfully. More importantly, effective organizations in general 
may be those that are wise enough to accept the reality of paradox in organizational 
life and bold enough to define their effectiveness in terms of its preservation. 


Learning 


HROs are distinguished by the fact that their modes of learning do not fall neatly 
into the currently popular distinction between exploitation and exploration 
(March, 1996). Exploitation involves the use and development of things already 
known, exploration involves the pursuit of new knowledge. The prevailing 
high reliability literature, however, cautions against exploration where trials can 
ramify in unexpected, dangerous ways. Exploitation, however, is also difficult 
because systems are understood imperfectly and all possible failure modes have 
not yet occurred. 

High reliability organizations seem to cope with these limits on exploitation 
and exploration in part through exploration of meaningful analogues. In the early 
debates over the lessons of Three Mile Island, LaPorte (1982, p. 189) called at- 
tention to the “need for analogous, less risky phenomena from which to learn” and 
suggested that nuclear power plants might learn analogically from petrochemical 
plants. Effective HROs, faced with infrequent failures, learn from the failures 
of others. What is unusual is that they are sensitive to the ways in which these 
“outside” failures are better or worse analogues of what they might experience. 
Thus, accidents on submarines and aircraft carriers are potentially more instructive 
to nuclear power plants than are accidents in petrochemical plants, since most 
contemporary submarines and carriers are nuclear powered. Failures within 
wildland firefighting crews (e.g., Weick, 1995) may be more instructive to aircraft 
crews than failures in nuclear power plant control room crews, since firefight- 
ing crews and cockpits crews have continuous rotation of personnel and control 
rooms do not. The intent in using these analogues as modes of exploration is to 
uncover assumptions people take for granted, trace out new implications of old 
assumptions, and identify latent organizational flaws. 
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But what is perhaps even more striking in our analysis is that high reliability is 
not totally dependent on conventional learning processes. We concur with those 
who argue that learning is stored in routines; but we also emphasize that as- 
sumptions store much of what an organization learns. Attention to failure and 
situational awareness seem to create many of the adaptive changes that would 
ordinarily be attributed to learning. Since surprise is the primary non-repetitive 
input that threatens reliable operations, other than strengthening the pro- 
cesses that heighten mindfulness, it is not obvious what can be learned from sur- 
prises that may happen only once and which may never happen again. It is as if, 
the more fully a system maintains a state of mindfulness, the less that remains to 
be explained by concepts of organizational learning. Said differently, when people 
in HROs concentrate on situational awareness, resilience, and containment, they 
deal with what is in front of them through operations that have an emergent quality 
similar to the activity of bricolage (Weick, 1993b). People combine fragments of 
old routines with novel actions into a unique response to deal with a unique input. 
‘To portray this rich mixture of perception, surprise, bricolage, and experience as 
mere learning would seem to conceal the fine-grain of complex adaptation that 
HROs actually accomplish. 


Levels of Analysis 


A further implication of our analysis is that there is nothing sacred about the organ- 
izational level of analysis when processes become the focus. Instead, to pursue 
reliability in a meaningful fashion is to pay closer attentions to systems (Carroll, 
1997, pp. 24-27), positions (Vaughan, 1996), or programs (Perrin, 1995, p. 162). 

Consider “systems,” for example. Perrow (1984) argues that the concern in 
normal accident theory is with system accidents rather than component failures, 
although he tends to draw systems somewhat narrowly (Vaughan, 1996). Woods, 
Johannesen, Cook, and Sorter (1993, p. 36) similarly argue for more attention 
to systems: “Erroneous actions that lead to bad consequences involve multiple 
people embedded in larger systems. It is this operational system that fails. When 
this system fails, there is a breakdown in cognitive activities, cognitive activities 
which are distributed across multiple agents and influenced by the artifacts used 
by those agents” (emphasis in original). It is also possible to move away from 
large systems to much smaller ones and argue that in HROs the operating crew 
enacts the organization. It is the risk handlers who embody the organization and 
its reputation in their manual, interpretive, experience-based work (Perrin, 1995, 
p. 158) and not the risk-analysts or others who espouse safety. As the Captain of 
the tanker Arco Anchorage put it, “The boat people can take the corporation down 
in one move” (Nalder, 1994, p. 223). The organization is the crew in the same sense 
that the organization is the meetings it convenes (Schwartzman, 1987, p. 288). 
The organization is realized and comes into being in its meetings and in the 
working of its crews. 

Concerns with a shift in level of analysis is consistent with Wiley’s (1988) sug- 
gestion that “organization” is not a meaningful level of analysis in social science. 
He argued, instead, that the sui generis breaks in the evolution of the social 
animal occur at the levels of the individual, the intersubjective (synthesis of two 
communicating selves), the generic subjective (self as filler of roles and follower 
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of rules), and the extrasubjective (pure meanings without a knowing subject as in 
culture). In the previous discussion, key issues were framed intersubjectively and 
dyadically (e.g., Van Braun rewards an engineer who volunteers that he may have 
caused a launch failure), generic subjectively (e.g., supervisors help overloaded air 
traffic controllers), and extrasubjectively (e.g., medication errors are reported when 
the culture is friendly to errors). It is conceivable that HROs have languished 
outside the mainstream of organizational theory precisely because they did not fit 
traditional definitions of organization. The lesson, however, may be that almost 
nothing looks like a conventional organization any more when we see forms shaped 
uniquely for high velocity environments (Eisenhardt, 1993), knowledge-intensive 
practice (Starbuck, 1993), hyperturbulence (D’Aveni, 1994), and virtual existence 
(Sotto, 1993). 

Given this rethinking of the appropriate level of analysis for conceptualizing 
HROs, it becomes less surprising that Vaughan (1996, pp. 413-415), in her analysis 
of the Challenger disaster, is able to move seamlessly between intimate dyads and 
NASA systems. She argues that turning points in intimate dyadic relationships 
occur when one partner begins to pull away from the other. These turning points 
show the very same pattern of normalization of signals of danger that she observed 
in the far more complex decision-making that led up to the Challenger disaster. 
In both cases, the focal object displays discontent/malfunctioning through weak, 
mixed signals that soon become treated mindlessly as they are embedded among 
other signals that have taken-for-granted meanings. In both cases, those mixed, 
embedded signals are seen to form a clear ominous pattern only when an exiting 
partner or an exploding space shuttle trigger retrospective sensemaking. 

The reason Vaughan is able to juxtapose images of such diverse complexity and 
size is that she maintains a consistent focus on process. She argued that intimate re- 
lationships are small organizations that exhibit organizing. “When we marry or 
live with another person, we develop a division of labor, share some goals, compete 
for scarce resources, and socialize new members. We come and go regularly, 
making decisions daily, creating precedents, decision streams, culture, and his- 
tory. Like their larger and more formal counterparts, these small organizations 
are also subject to failures with human consequences.” Thus, the feedstock for 
studies of reliable organizing is much closer at hand than a nuclear power plant, 
aircraft carrier, or chemical plant. The fundamental processes involved in reliable 
performance are processes indigenous to all relationships that matter. 


Requisite Variety 


Finally, the concept of requisite variety has been central in previous discussions 
of HROs and it remains central in our analysis. However, when pushed, this 
concept raises other questions, one of which is when does requisite variety help 
and when does it hamper the pursuit of reliability? We noted earlier Schulman’s 
redefinition of requisite variety as conceptual slack: “a divergence in analytical 
perspectives among members of an organization over theories, models, or causal 
assumptions pertaining to its technology or production processes” (Schulman, 
1993b, p. 364). This definition resembles Turner’s description of the variable 
disjunction of information. Variable disjunction refers “to a complex situation in 
which a number of parties handling a problem are unable to obtain precisely the 
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same information about the problem so that many differing interpretations of 
the problem exist” (Turner, 1978, p. 50). Our focus is on the similarity between 
Schulman’s “divergence in analytical perspectives” and Turner’s “many different 
interpretations of the problem.” 

Early work by Reeves and Turner (1972, p. 91) elaborated the idea of variable 
disjunction this way. “It is variable because the state is not one in which no infor- 
mation can be exchanged or amplified to remove discrepancies: such exchanges 
are constantly being made, so that the content of the sets of information which are 
disjoined is always varying. However, no single agreed-upon description of the 
situation exists. People who have to operate in a situation in which there is dis- 
junction of information are unlikely to reach complete consensus about the 
information which describes the total situation, simply because of the problem 
of convincing others of the status of their own set of information and thus of the 
validity of their analysis of the situation and their suggestions for action.” What 
is jarring when we juxtapose Schulman and Turner is that conceptual slack sup- 
posedly reduces the incidence of disasters whereas variable disjunction increases 
the incidence. Are diverse perspectives dangerous or an investment in safety? 

We suspect that important boundary conditions for requisite variety are 
implicit in the answer. Divergent perspectives may reduce the incidence of disaster 
when they occur within an organization (Schulman speaks of members of an 
organization) or when tasks are not decomposable, but increase the likelihood of 
incidence when they cross boundaries and connect multiple organizations or when 
tasks are decomposable. Turner’s data show that it is commonplace for disasters 
to happen “when a large complex problem, the limits of which were difficult to 
specify, was being dealt with by a number of groups and individuals usually 
operating in separate organizations” (Turner, 1976, p. 384). This suggests that 
reliability will be an emerging concern as organizations increasingly participate 
in interorganizational networks because interorganizational coordination is so 
difficult to achieve and because the system becomes more complex and harder 
to comprehend. 

Our analysis updates thinking on requisite variety, but it also raises a number of 
other issues. For example, if we focus on key phrases in Reeves and Turner (1972), 
then additional boundary conditions become clearer. Requisite variety may have 
the potential to increase disasters when corporate cultures emphasize, 

(1) accuracy rather than plausibility: A culture that values accuracy may in- 
fluence people to withhold judgments and communication until they have 
“precisely the same information” and can demonstrate “the validity of their 
analysis.” Since accuracy is difficult to demonstrate in a dynamic partially 
understood environment, norms that favor accuracy may silence the reporting of 
imprecise hunches about anomalies that could cumulate into crises. 

(2) advocacy rather than active listening: If people define their job as “con- 
vincing others of the validity of their own set of information” rather than listening 
to others to determine the validity of their own information, then advocacy 
replaces analysis and synthesis. As a result, subtle cues that are ordinarily registered 
when requisite variety is high, go unacknowledged and the errors they point to 
are left unattended and remain available for cumulation. 

(3) constant rather than periodic exchange of information: A culture in which 
information “exchanges are constantly being made,” may make it harder to detect 
small changes than one in which exchanges are periodic. With periodic exchanges, 
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contrasts between past and present become more clear-cut than is the case when 
exchange is continuous. With more frequent reporting, there is less change to 
report and more of a tendency to assimilate a current report to an earlier report 
(Hutchins, 1991). Errors that begin to cumulate in a single direction go unnoticed 
when exchange is continuous. This suggests that there may be an optimal fre- 
quency or periodicity for information exchange that varies from organization to 
organization. But it also suggests that continual talk is problematic as a blanket 
formula for increased reliability. 

(4) complete consensus rather than partial “working” consensus: A culture that 
encourages people to seek a “single agreed-upon description” and to “reach com- 
plete consensus” ignores the reality of diversity in experiences and the impossibility of 
anything more than general agreement. Pressure for consensus is dangerous be- 
cause it stifles the reporting of anomalies and because it takes time to attain it, time 
during which conditions can worsen and origins become harder to uncover. 


Thus, high requisite variety may not improve reliable performance unless it is 
developed intra-organizationally as part of a context that encourages plausible judg- 
ment, active listening, periodic information exchange, and a working consensus. 
Departures from any of these potential boundary conditions may turn a system 
that uses variety to destroy variety into one in which variety amplifies variety. 


Practice Refinements 


Perhaps the key question for practice is, does it make sense for mainstream organ- 
izations to invest time, energy, and human resources in processes of high reliability 
in order to prevent mistakes of relatively minor consequence? The answer is more 
straightforward for HROs driven by failure-avoidance and the prospect of catas- 
trophe than it is for traditional efficiency-oriented organizations driven by success 
and the prospect of a weak bottom line. Although that is a gross simplification, 
it does reach the point that safety costs money (Wildavsky, 1991, p. 214). And 
when safety boils down to the non-occurrence of bad outcomes, there is strong 
temptation to use that non-occurrence as proof that an investment in safety is no 
longer necessary (Starbuck & Milliken, 1988). 

The piece that is missing in this tidy picture is that it is not just safety that 
costs money. Learning does too. And this is where the pragmatics of reliability and 
efficiency begin to blend. If we view safety as a process of search and learning 
(Wildavsky, 1991, p. 207), then the costs of building an infrastructure that in- 
duces mindfulness, can be viewed as an investment in both learning and safety. 
Investments in safety are defined as investments in mindfulness that mean greater 
familiarity with the system, an enlarged response repertoire, and clearer ac- 
countability, all of which can create competitive advantage (Thompson, 1995). 
‘To invest in mindfulness is to assign a high priority to the probability of error 
and to the importance of responsibility for mistakes, internal criticism, and the 
removal of self-serving defensive postures (Landau & Chisholm, 1995, p. 77). 
Furthermore, to encourage mindfulness is to tap into intrinsic motivation and 
increase performance-enhancing perceptions of efficacy and control (Langer, 
1997; Pfeffer, 1997, pp. 67-71). But whether a high reliability approach leads to 
sufficient returns in the form of avoided disasters or enhanced performance 
to justify its implementation, remains an empirical question, difficult to assess and 
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perhaps ultimately unknowable. The choice by mainstream organizations to pursue 
high reliability organizing in the absence of obvious threats may ultimately be an 
issue of identity and appropriateness (who do we want to be and how do we want 
to go about our business), rather than an issue of reality and consequentiality 
(March & Olsen, 1989, pp. 21-52). 

An additional question for practice is, what is new here in our analysis of 
mindful organizing in HROs? That question arises in part because many of the 
recommendations that flow from HROs sound like what Perrow (1987) calls 
“motherhood items.” He argues that few managers would question the value of 
intense effort, group trust, complete knowledge of how everything works, no 
mistakes by anyone, buffers to contain failure, clear specifications of jobs, thought- 
ful plans, ample resources, redundancy, conforming to rules, complex skills for 
complex work, constant alertness, continuous learning, open and frequent com- 
munication, and effective leadership. It is lists like this that lead some observers 
to equate good management with safe management (e.g., Allinson, 1993). 

Part of what’s missing from any list of motherhood items are contingent pro- 
positions, propositions such as high requisite variety promotes reliability in non 
decomposable tasks but hinders reliability in decomposable tasks. But one is also 
tempted to say, what’s missing here are “good mothers.” If these are motherhood 
items, then a case can be made that in a downsized, outsourced, acquisitive, 
divesting, reorganizing, insecure, competitive world, a good mother is hard to find. 
Managers aren’t managing because, with too few resources, they don’t have the 
time to. Absorption in details normally handled by subordinates keeps managers 
from coordinating, building overviews, increasing the capacity for resilience, and 
anticipating much farther than the next week, let alone the next quarter. Managers 
faced with these pressures are not just overworked. They are dangerous because 
of the potential to make high level errors that disperse and cumulate. And that’s 
where a thorough understanding of HROs begins to produce a different set of 
insights into organizing. 

The lessons to be learned from HROs are not just lessons of motherhood, 
although successful implementation of even those lessons could be the source of 
competitive advantage. In fact, many organizations are already capable of serious 
failure that can create serious harm, but are unable to see these possibilities 
(Roberts & Libuser, 1993; Rochlin, 1997) and may benefit from the lessons out- 
lined here. Additional lessons implicit in the preceding analysis include, 


1. The expectation of surprise is an organizational resource because it pro- 
motes real-time attentiveness and discovery (Schulman, 1993b, p. 368). 

2. Anomalous events should be treated as outcomes rather than accidents, to 
encourage search for sources and causes (Edmondson, 1996). 

3. Errors should be made as conspicuous as possible to undermine self- 
deception and concealment (Tamuz, 1994). 

4. Reliability requires diversity, duplication, overlap, and a varied response 
repertoire, whereas efficiency requires homogeneity, specialization, non- 
redundancy, and standardization (Landau & Chisholm, 1995, p. 68). 

5. Interpersonal skills are just as important in HROs as are technical skills 
(Westrum, 1997). 
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Lessons such as these have direct implications for practice issues such as those 
that focus on quality and decentralization to name two examples described below. 

There is some overlap between practices that improve quality and practices 
that induce mindful error detection and correction. Our hunch is that the greater 
the overlap, the higher the incidence of sustained quality improvement. There are 
obvious parallels even when the overlap is modest. The core concern in quality 
programs with the elimination of defects and reducing variability has obvious 
links with goals in HROs. Recall that Deming (1982) emphasized defining quality 
efforts in terms of a sustained and broad-based organizational vigilance for finding 
and addressing problems over and above those found through standard statistical 
process control methods. Moreover, if high reliability organizing is understood in 
part as a strategy to deploy attention, quality practices could be viewed as devices to 
direct and channel that attention. A process orientation in quality programs 
focuses attention on issues such as the interrelation of units or individuals, origins 
of errors, and the consequences of different process changes (Winter, 1994). 
Customer focus directs attention beyond an internal focus toward consideration 
of a larger set of consequences. And systematic and continual attention to fact- 
based analysis heightens awareness of potential and existing errors. 

All of these processes intended to improve quality have their counterparts in 
HRO processes that deal with failure, resilience, and operations. Interestingly, 
however, quality programs seem to overlook HRO processes that reduce sim- 
plification and loosen structures. These two oversights may explain why some 
total quality efforts fail. When quality programs preserve simplification and tight 
structure they ignore complex, emergent problems (Sitkin, Sutcliffe, and 
Scchroeder, 1994). We interpret this preservation as a clear case of stable routines 
and variable cognitive process, a combination that may be dysfunctional. 

There are limits, however, in the extent to which a move toward total quality 
represents a move toward high reliability. Organizations may adopt total qual- 
ity programs as much for institutional reasons as for reasons of enhanced perform- 
ance (Westphal, Gulati, & Shortell, 1997). The pursuit of legitimacy through 
adoption of formal quality programs neutralizes the mindful pursuit of reliability. 
Similar neutralization of mindfulness occurs if quality programs are adopted as 
part of a fad (Abrahamson, 1996). Finally, the very quality practices designed to 
encourage mindfulness may themselves become routinized and mindless in the 
interest of efficiency. In each of these cases improvements in quality processes 
bypass several features of the cognitive infrastructure associated with HROs. 

HROs have implications for decentralization, as well as quality. As systems 
increase in complexity, centralized organizations lose the ability to respond at 
local levels (Lustick, 1980). In these cases they must delegate authority to create 
a more elaborate sensing mechanism capable of detecting possible dangers on a 
local level. This delegated capacity for local detection must be held simultaneously 
with a centralized capacity that maintains the organization’s larger awareness of 
its vulnerability and serves to coordinate responses and learning that occur at the 
local level. In high reliability organizations decentralization and centralization 
are held in critical balance (Weick, 1987), often by means of tight social coupling 
around a handful of core cultural values, and looser coupling around the means 
by which these values are realized. In ordinary organizations where reliability is 
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becoming increasingly important, excess centralization may weaken local con- 
tainment and resolution of problems, while excess decentralization may weaken the 
comprehension of wider threats and of the capacity to coordinate responses. 

Consider the practice of outsourcing. Many organizations confront external 
conditions that are tightly coupled and interactively complex (e.g., increased com- 
petition and reduced slack). To control costs more organizations resort to practices 
such as outsourcing. Outsourcing sacrifices many of the reliability-enhancing 
qualities of decentralization such as more fine-grained local understanding of 
complex environments and swift detection, isolation, and resolution of problems. 
For example, when Valujet outsourced maintenance to Sabre-Tech, this reduced 
the complexity of Valujet but it did not reduce the complexity of the system within 
which it operated. That system became more interactively complex and harder 
to comprehend. Thus, when Valujet outsourced it made itself less complex at the 
very moment that its interdependencies became more interactively complex. In 
our terminology Valujet lost requisite variety right when they needed to increase 
it. Outsourcing appears to be one of a growing number of devices for cost-saving 
that also leave firms with less variety to cope. Outsourcing of maintenance is also 
a good example of removing an antecedent of mindfulness (preoccupation with 
failure), thereby reducing the capability for error detecting. When maintenance is 
outsourced, the supplier, not the buyer, now must become preoccupied with failure, 
which means that the buyer becomes more mindless. That may be unimportant if 
the buyer faces only predictable forms of failure that are easy to anticipate. But if 
novel forms of failure are possible, then the loss of a preoccupation with failure 
to an outsider could make the buyer less mindful and more vulnerable. 


Conclusion 


Effective HROs organize socially around failure rather than success in ways 
that induce an ongoing state of mindfulness. Mindfulness, in turn, facilitates the 
discovery and correction of anomalies that could cumulate with other anomalies 
and grow into a catastrophe. Mindfulness, with its rich awareness of discriminatory 
detail, enables people to manage juxtapositions of events they have never seen 
before. But the ways in which they do this are still not fully understood. Our ana- 
lysis represents an effort to further this understanding. 

Effective HROs represent complex adaptive systems that combine orderly pro- 
cesses of cognition with variations in routine activities in order to sense and manage 
complex ill-structured contingencies. In a dynamic, unknowable, unpredictable 
world one might presume that organizing in a manner analogous to HROs would 
be in the best interest of most organizations. Hints of such moves are evident 
when traditional organizations graft TQM cultures onto a pre-existing preoccu- 
pation with efficiency, and aspire to the relatively error-free performance found in 
HROs. But many of these attempted changes fail because traditional organizations 
demonstrate little awareness of just what kind of infrastructure it takes to support 
reliable performance. Unfortunately, mainstream organizational theory isn’t much 
help in developing this awareness. 

The purpose of our analysis has been to consolidate conceptually a body of 
work that begins to articulate the social infrastructure of reliability. The language 
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of a near miss, having the bubble, migrating decisions, conceptual slack, resilience, 
normal accidents, redundancy, variable disjunction, struggle for alertness, per- 
formance pressure, situational awareness, interactive complexity, and prideful 
wariness, describes how people organize around failures in ways that induce 
mindful awareness. That mindfulness, in turn, reveals unexpected threats to well 
being that can escalate out of control. And that, in our estimation, is a central 
theme for mainstream organizational theory. 


Acknowledgments 


We wish to thank Barry Staw, Charles Perrow, Gene Rochlin, John Carroll, Ron Westrum, 
Robert Burgelman, Diane Vaughan, Michael Cohen, Gary Klein, and especially Paul Schulman 
and Kyle Weick, for their help improving various drafts of this analysis. 


References 


Abrahamson, E. (1996). Management fashion. Academy of Management Review, 21, 254-285. 

Allinson, R.E. (1993). Global disasters. New York: Prentice Hall. 

Bierly, P.E., & Spender, J.-C. (1995). Culture and high reliability organizations: The case of the 
nuclear submarine. Journal of Management, 21, 639-656. 

Bourrier, M. (1996). Organizing maintenance work at two nuclear power plants. Journal of 
Contingencies and Crisis Management, 4, 104-112. 

Campbell, D.T. (1990). Asch’s moral epistemology for socially shared knowledge. In Irwin Rock 
(Ed.), The legacy of Solomon Asch: Essays in cognition and social psychology (pp. 39-52). Hillsdale, 
NJ: Erlbaum. 

Cameron, K.S. (1986). Effectiveness as paradox: Consensus and conflict in conceptions of 
organizational effectiveness. Management Science, 32, 539-553. 

Cameron, K.S. (1995). “Organizational effectiveness.” In N. Nicholson (Ed), Encyclopedic dictionary 
of organizational behavior (pp. 391-395). Cambridge, MA: Blackwell. 

Carroll, J.S. (1997). Organizational learning activities in high hazard industries: The logics underlying 
self-analysis. Working paper no. 3936, MIT, Cambridge, Massachusetts. 

Cohen, M.D., March, J.G., & Olsen, J.P. (1972). A garbage can model of organizational choice. 
Administrative Science Quarterly, 17, 1-25. 

Creed, W.E.D., Stout, S.K., & Roberts, K. (1993). Organizational effectiveness as a theoretical 
foundation for research on reliability-enhancing organizations. In K.H. Roberts (Ed.), New 
challenges to understanding organizations (pp. 55-74). New York: Macmillan. 

Danton, G. (1991). The theory and practice of seamanship (11th edition). London: Routledge. 

D’Aveni, R. (1994). Hypercompetition: Managing the dynamics of strategic maneuvering. New York: 
Free Press. 

Deming, E.W. (1982). Quality, Productivity, and Competitive Position, Cambridge. Boston: MIT, 
Center for Advanced Engineering Study. 

Edmondson, A.C. (1996). Learning from mistakes is easier said than done: Group and organ- 
izational influences on the detection and correction of human error. Journal of Applied 
Behavioral Science, 32, 5-28. 

Eisenhardt, K.M. (1993). High reliability organizations meet high velocity environments: 
Common dilemmas in nuclear power plants. In K.H. Roberts (Ed.), New challenges to 
understanding organizations (pp. 33-54). New York: Macmillan. 

Endsley, M.R. (1995). Toward a theory of situation awareness in dynamic systems. Human 
Factors, 37, 32-64. 

Endsley, M.R. (1997). The role of situation awareness in naturalistic decision making. In 
C. Zsambok and G. Klein (Eds.), Naturalistic decision making (pp. 269-284). Mahwah, 
NJ: Erlbaum. 

Feldman, M.S. (1989). Order without design: Information production and policy making. Stanford, 
CA: Stanford University Press. 


weick, sutcliffe and obstfeld m™ organizing for high reliability 63 


Hannan, M.T., & Freeman, J. (1984). Structural inertia and organizational change. American 
Sociological Review, 49, 149-164. 

Harper, D.A. (1987). Working knowledge: Skill and community in a small shop. Chicago: University 
of Chicago Press. 

Hollnagel, E. (1993). Human reliability analysis: Context and control. London: Academic Press. 

Husted, B.W. (1993). Reliability and the design or ethical organizations. Journal of Business 
Ethics, 12, 761-769. 

Hutchins, E. (1990). The technology of team navigation. In J. Galegher (Ed.), Intellectual 
teamwork: Social and Technological Foundations of Cooperative Work (pp. 191-220). Hillsdale, 
NJ: Lawrence Erlbaum. 

Hutchins, E. (1991). The social organization of distributed cognition. In L.B. Resnick, J.M. Levine, 
and S.D. Teasley (Eds.), Perspectives on socially shared cognition (pp. 283-307). Washington, 
DC: American Psychological Association. 

Hynes, T., & Prasad, P. (1997). Patterns of “mock bureaucracy” in mining disasters: An analysis 
of the Westray coal mine explosion. Journal of Management Studies, 34, 601-623. 

Jervis, R. (1976). Perception and misperception in international politics. Princeton: Princeton 
University Press. 

Klimoski, R., & Mohammed, S. (1994). Team mental model: Construct or metaphor? Journal 
of Management, 20, 403-437. 

Kmetz, J.L. (1984). An information processing study of a complex workflow in aircraft electronics 
repair. Administrative Science Quarterly, 29, 255-280. 

Landau, M. (1969). Redundancy, rationality, and the problem of duplication and overlap. Public 
Administration Review, 29, 346-358. 

Landau, M., & Chisholm, D. (1995). The arrogance of optimism: Notes on failure avoidance 
management. Journal of Contingencies and Crisis Management, 3, 67-80. 

Langer, E.J. (1989). Minding matters: The consequences of mindlessness-mindfulness. 
In L. Berkowitz (Ed.), Advances in experimental social psychology (vol. 22, pp. 137-173). 
San Diego: Academic Press. 

Langer E.J. (1997). The power of mindful learning. Reading, MA: Addison-Wesley. 

LaPorte, T-R. (1982). On the design and management of nearly error-free organizational control 
systems. In D.L. Sills, C.P. Wolf, and V.B. Shelanski (Eds.), Accident at Three Mile Island: The 
human dimensions (pp. 185-200). Boulder, CO: Westview. 

LaPorte, TR. (1988). The United States air traffic system: Increasing reliability in the midst 
of rapid growth.” In R. Mayntz and T. Hughes (Eds.), The development of large scale technical 
systems (pp. 215-244). Boulder: Westview Press. 

LaPorte, T:R. (1994). A strawman speaks up: Comments on The Limits of Safety. Journal of 
Contingencies and Crisis Management, 2, 207-211. 

LaPorte, TR. (1996). High Reliability Organizations: Unlikely, Demanding and At Risk. Journal 
of Contingencies and Crisis Management, 4, 60-71. 

LaPorte, T-R., & Consolini, P. (1991). Working in practice but not in theory: Theoretical 
challenges of high reliability organizations. Journal of Public Administration Research and 
Theory, 1 (winter), 19-47. 

LaPorte, T:R., Jr., & Rochlin, G. (1994). A Rejoinder to Perrow. Journal of Contingencies and 
Crisis Management, 2, 221-227. 

Larson, J.R., Jr., Christensen, C., Abbott, A.S., & Franz, T.M. (1996). Diagnosing groups: 
Charting the flow of information in medical decision-making teams. Journal of Personality 
and Social Psychology, 71, 315-330. 

Lerner, A.W. (1986). There is more than one way to be redundant. A comparison of alternatives 
for the design and use of redundancy in organizations. Administration and Society, 18, 
334-359. 

Levi-Strauss, C. (1966). The savage mind. Chicago: University of Chicago Press. 

Lustick, I. (1980). Explaining the variable utility of disjointed incrementalism: Four propositions. 
The American Political Science Review, 74, 342-353. 

March, J.G. (1994). A primer on decision making: How decisions happen. New York: Free Press. 

March, J.G. (1996). Exploration and exploitation in organizational learning. In M.D. Cohen and 
L.S. Sproull (Eds.), Organizational learning (pp. 101-123). Thousand Oaks, CA: Sage. 

March, J.G., & Olsen, J.P. (1986). Garbage can models of decision making in organizations. In 
J.G. March and R. Weissinger-Baylon (Eds.), Ambiguity and command (pp. 11-35). Marshfield, 
MA: Pitman. 


64 _ challenges of crisis management 


March, J.G., & Olsen, J.P. (1989). Rediscovering institutions. New York: Free Press. 

March, J.G., Sproull, L.S., & Tamuz, M. (1991). Learning from samples of one or fewer. 
Organization Science, 2, 1-13. 

Marcus, A. (1995). Managing with danger. Industrial and Environmental Crisis Quarterly, 9, 
139-152. 

Marcus, A., Nichols, M.L., & McAvoy, G.E. (1993). Economic and behavioral perspectives 
on safety. In L.L. Cummings and B. Staw (Eds.), Research in organizational behavior (vol. 15, 
pp. 323-355). Greenwich, CT: JAI Press. 

Meacham, J.A. (1983). Wisdom and the context of knowledge: Knowing that one doesn’t 
know. In D. Kuhn and J.A. Meacham (Eds.), On the development of developmental psychology 
(pp. 111-134). Basel, Switzerland: Karger. 

Meshkati, N. (1989). Se/f-organization, requisite variety, and cultural environment: Three links of a 
safety chain to harness complex technological systems. Paper presented at the Workshop on Safety 
Control and Risk Management, World Bank, Karlstad, Sweden. 

Miller, D. (1993). The architecture of simplicity. Academy of Management Review, 18, 116-138. 

Miller, T-E., & Woods, D.D. (1997). Key issues for naturalistic decision making researchers in 
system design. In C. Zsambok and G. Klein (Eds.), Naturalistic decision making (pp. 141-150). 
Mahwah, NJ: Erlbaum. 

Nalder, E. (1994). Tankers full of trouble: The perilous journey of Alaskan crude. New York: Grove 
Press. 

Nelson, R., & Winter, S. (1982). An evolutionary theory of economic change. Cambridge, MA: 
Belknap. 

Osborn, R.N., & Jackson, D.H. (1988). Leaders, riverboat gamblers, or purposeful unintended 
consequences in the management of complex, dangerous technologies. Academy of Management 
Journal, 31, 924-947. 

Pauchant, T.C., Mitroff, LI., Weldon, D.N., & Ventolo, G.F. (1991). The ever-expanding scope 
of industrial crises: A systematic study of the Hinsdale telecommunication outage. Industrial 
Crisis Quarterly, 4, 243-261. 

Pearson, C.M., & Mitroff, II. (1992). From crisis prone to crisis prepared: A framework for 
crisis management. Academy of Management Executives, 7, 48-59. 

Perrin, C. (1995). Organizations as contexts: Implications for safety science and practice. Industrial 
and Environmental Crisis Quarterly, 9, 152-174. 

Perrow, C. (1984). Normal accidents: Living with high-risk technologies. New York: Basic Books. 

Perrow, C. (1986). Complex organizations (3rd ed.). New York: Random House. 

Perrow, C. (1987). Reliability: Comments on project materials. Unpublished manuscript, Yale 
University. 

Perrow, C. (1994a). The limits of safety: The enhancement of a theory of accidents. Journal of 
Contingencies and Crisis Management, 2, 212-220. 

Perrow, C. (1994b). Accidents in high-risk systems. Technology Studies, 1, 1-20. 

Pfeffer, J. (1997). New directions for organization theory. New York: Oxford. 

Rasmussen, J., & Batstone, R. (1989). Why do complex organizational systems fail? Environment 
Working Paper No. 20. The World Bank. 

Reason, J. (1990). Human error. New York: Cambridge University Press. 

Reeves, T:K., & Turner, B.A. (1972). A theory of organization and behavior in batch production 
factories. Administrative Science Quarterly, 17, 81-95. 

Rijpma, J.A. (1997). Complexity, tight-coupling and reliability: Connecting normal accidents 
theory and high reliability theory. Journal of Contingencies and Crisis Management, 5(1), 
15-23. 

Roberts, K.H. (1990). Some characteristics of high reliability organizations. Organization Science, 
1, 160-177. 

Roberts, K.H., & Creed, W.E.D. (1993). Epilogue. In K.H. Roberts (Ed.), New challenges to 
understanding organizations (pp. 249-256). New York: Macmillan. 

Roberts, K.H., & Leuschner, R.L. (in press). Bishop Rock dead ahead: The grounding of the 
U.S.S. Enterprise. Naval Institute Proceedings. 

Roberts, K.H., & Libuser, C. (1993). From Bhopal to banking: Organizational design can mitigate 
risk. Organizational Dynamics, 21, 15-26. 

Roberts K.H., & Rousseau, D.M. (1989). Research in nearly failure-free, high-reliability systems: 
“Having the bubble.” IEEE Transactions on Engineering Management, 36, 132-139. 


weick, Sutcliffe and obstfeld m™ organizing for high reliability 65 


Roberts, K.H., Stout, $.K., & Halpern, J.J. (1994). Decision dynamics in two high reliability 
military organizations. Management Science, 40, 614-624. 

Rochlin, G.I. (1989). Informal organizational networking as a crisis avoidance strategy: U.S. 
naval flight operations as a case study. Industrial Crisis Quarterly, 3, 159-176. 

Rochlin, G.I. (1993). Defining “high reliability” organizations in practice: A taxonomic prologue. 
In K.H. Roberts (Ed.), New challenges to understanding organizations (pp. 11-32). New York: 
Macmillan. 

Rochlin, G.I. (1997). Trapped in the net. Princeton, NJ: Princeton University Press. 

Rochlin, G., LaPorte, T., & Roberts, K. (1987). The self-designing high reliability organization: 
Aircraft carrier flight operation at sea. Naval War College Review, 40, 76-90. 

Roth, E.M. (1997). Analysis of decision making in nuclear power plant emergencies: An 
investigation of aided decision making. In C. Zsambok and G. Klein (Eds.), Naturalistic 
decision making (pp. 175-182). Mahwah, NJ: Erlbaum. 

Ryle, G. (1979). Improvisation. In G. Ryle, On thinking (pp. 121-130). London: Blackwell. 

Sagan, S.D. (1993). The limits of safety: Organizations, accidents and nuclear weapons. Princeton, 
NJ: Princeton University Press. 

Sagan, S.D. (1994). Toward a political theory of organizational reliability. Journal of Contingencies 
and Crisis Management, 2, 228-240. 

Schulman, P.R. (1993a). The analysis of high reliability organizations: A comparative framework. 
In K.H. Roberts (Ed.), New challenges to understanding organizations (pp. 33-54). New York: 
Macmillan. 

Schulman, P.R. (1993b). The negotiated order of organizational reliability. Administration and 
Society, 25, 353-372. 

Schwartzman, W.R. (1987). The significance of meetings in an American mental health center. 
American Ethnologist, 14, 271-294. 

Scott, W.R. (1994). Open peer commentaries on “Accidents in high-risk systems.” Technology 
Studies, 1, 23-25. 

Shin, R.W., & Sung, D.-K. (1995). Disaster recovery plans for computer system failures: An 
empirical study of the state of preparedness of American country government. Journal of 
Contingencies and Crisis Management, 3, 91-102. 

Sitkin, $.B. (1992). Learning through failure: The strategy of small losses. In B.M. Staw and 
L.L. Cummings (Eds.), Research in organizational behavior (vol. 14, pp. 231-266). Greenwich, 
CT: JAI Press. 

Sitkin, S.B., Sutcliffe, K.M., & Schroeder, R.G. (1994). Distinguishing control from learning 
in total quality management: A contingency perspective. Academy of Management Review, 
18), 537-564. 

Sotto, R. (1993). The virtual organisation. PP1993:2, University of Stockholm, Dept. of Business 
Administration. Unpublished manuscript. 

Starbuck, W.H. (1993). Learning by knowledge-intensive firms. Journal of Management Studies, 
29, 713-740. 

Starbuck, W.H. Greve, A., & Hedherg, B.L.T. (1978). Responding to crises: Theory and the 
experience of European business. In C.F. Smart and W.T. Stanbury (Eds.), Studies in crisis 
management (pp. 107-134). Toronto: Butterworth. 

Starbuck, W.H., & Milliken, FJ. (1988). Challenger: Fine-tuning the odds until something breaks. 
Journal of Management Studies, 25, 319-340. 

Sutcliffe, K.M. (1994). What executives notice: Accurate perceptions in top management teams. 
Academy of Management Journal, 37, 1360-1378. 

Tamuz, M. (1994). Developing organizational safety information systems for monitoring potential 
dangers. In G.E. Apostolakis and T-S. Win (Eds.), Proceedings of PSAM II, 2 (pp. 7-12). Los 
Angeles: University of California. 

Thompson, F. (1995). Business strategy and the Boyd cycle. Journal of Contingencies and Crisis 
Management, 3, 81-90. 

Thordsen, M.L., & Klein, G.A. (1989). Cognitive processes of the team mind. Proceedings of the 
IEEE International Conference on Systems, Man, and Cybernetics. Cambridge, MA. 

Turner, B. (1976). The organizational and interorganizational development of disasters. 
Administrative Science Quarterly, 21, 378-397. 

Turner, B. (1978). Man-made disasters. London: Wykeham Publications. 


66 challenges of crisis management 


Turner, B., & Pidgeon, N.F. (1997). Man-made disasters (2nd ed.). Oxford, UK: Butterworth- 
Heinemann. 

Vaughan, D. (1986). Uncoupling: Turning points in intimate relationship. New York: Oxford 
University Press. 

Vaughan, D. (1996). The Challenger launch decision. Chicago: University of Chicago Press. 

Weick, K.E. (1969). The social psychology of organizing. Reading, MA: Addison-Wesley. 

Weick, K.E. (1979). The social psychology of organizing (2nd ed.). Reading, MA: Addison-Wesley. 

Weick, K.E. (1987). Organizational culture as a source of high reliability. California Management 
Review, 29, 112-127. 

Weick, K.E. (1988). Enacted sensemaking in crisis situations. Journal of Management Studies, 
25, 305-317. 

Weick, K.E. (1990a). Technology as equivoque: Sensemaking in new technologies. In 
P.S. Goodman and L. Sproull (Eds.), Technology and Organizations (pp. 1-44). San Francisco: 
Jossey-Bass. 

Weick, K.E. (1990b). The vulnerable system: An analysis of the Tenerife air disaster. Journal of 
Management, 16, 571-593. 

Weick, K.E. (1993a). The collapse of sensemaking in organizations: The Mann Gulch disaster. 
Administrative Science Quarterly, 38, 628-652. 

Weick, K.E. (1993b). Organizational redesign as improvisation. In G.P. Huber and W.H. Glick 
(Eds.), Organizational change and redesign: Ideas and insights for improving performance 
(pp. 346-382). New York: Oxford. 

Weick, K.E. (1995). South Canyon revisited: Lessons from high reliability organizations. Wildfire, 
4(4), 54-68. 

Weick, K.E. (1998). The attitude of wisdom: Ambivalence as the optimal compromise. In 
S. Shrivasta and D.L. Cooperrider (Eds.), Organizational wisdom and executive courage 
(pp. 40-64). San Francisco: Lexington. 

Weick, K.E., & Roberts, K.H. (1993). “Collective mind in organizations: Heedful interrelating 
on flight decks. Administrative Science Quarterly, 38, 357-381. 

Westphal, J.D., Gulati, R., & Shortell, S.M. (1997). Customization or conformity: An institutional 
network perspective on the content and consequences of TQM adoption.” Administrative 
Science Quarterly, 42, 366-394. 

Westrum, R. (1988). Organizational and inter-organizational thought. Paper presented at the World 
Bank Conference on Safety Control and Risk Management. 

Westrum, R. (1992). Cultures with requisite imagination. In J.A. Wise, D. Hopkin, and P. Stager 
(Eds.), Verification and validation of complex systems: Human factors issues (pp. 401-416). Berlin: 
Springer-Verlag. 

Westrum, R. (1997). Social factors in safety-critical systems. In F. Redmill and J. Rajan (Eds.), 
Human factors in safety critical systems (pp. 233-256). London: Butterworth-Heinemann. 
Whetten, D.A., & Cameron, K.S. (1994). Organizational effectiveness: Old models and new 
constructs. In J. Greenberg (Ed.), Organizational behavior: The state of the science (pp. 135-154). 

Hillsdale, NJ: Erlbaum. 

Wildavsky, A. (1991). Searching for safety. New Brunswick: Transaction Books. 

Wiley, N. (1988). The micro-macro problem in social theory. Sociological Theory, 6, 254-261. 

Winter, S. (1994). Organizing for continuous improvement: Evolutionary theory meets the 
quality revolution. In J.A.C. Baum and J.V. Singh (Eds.), Evolutionary dynamics of organizations 
(pp. 90-108). New York: Oxford University Press. 

Woods, D.D. (1988). Coping with complexity: The psychology of human behavior in complex 
systems. In L.P. Goodstein, H.B. Andersen, and S.E. Olsen (Eds.), Tasks, errors, and mental 
models (pp. 128-148). New York: Taylor and Francis. 

Woods, D.D., Johannesen, L.J., Cook, R.I., & Sarter, N.B. (1993). Bebind human error: Cognitive 
systems, complexity, and hindsight. Unpublished manuscript. The Ohio State University. 
Xiao, Y., Milgram, P., & Doyle, J.D. (1997). Capturing and modeling planning expertise in 
anesthesiology: Results of a field study. In C. Zsambok and G. Klein (Eds.), Naturalistic 

decision making (pp. 197-207). Mahwah, NJ: Erlbaum. 


